{ "version": "Notebook/1.0", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "da8b6813-e862-406d-be73-aed634a083a2", "cellValue": "setTab", "linkTarget": "parameter", "linkLabel": "Alert Overview", "subTarget": "Alert Overview", "style": "link", "linkIsContextBlade": true }, { "id": "75b5e827-ff38-4252-bbd1-6beedbfe4534", "cellValue": "setTab", "linkTarget": "parameter", "linkLabel": "Cyber Threat Overview", "subTarget": "Cyber Threat Overview", "style": "link" }, { "id": "e4bdb76d-c81a-498f-b0ba-5130dba5d9ab", "cellValue": "setTab", "linkTarget": "parameter", "linkLabel": "IOC Overview", "subTarget": "IOC Overview", "style": "link" }, { "id": "d76fe7f8-78c7-4537-8de6-7d8a1d050478", "cellValue": "setTab", "linkTarget": "parameter", "linkLabel": "Close Proximity Overview", "subTarget": "Close Proximity Overview", "style": "link" }, { "id": "6de2158e-490d-4bed-85c4-f6e87706afc5", "cellValue": "setTab", "linkTarget": "parameter", "linkLabel": "Alerts Drilldown", "subTarget": "Alerts Drilldown", "style": "link" } ] }, "name": "links - 13" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Dataminr Alert Overview\r\n### Watchlists created in Dataminr" }, "name": "text - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "9c52736d-df9f-4db2-a196-6395ba392fe2", "version": "KqlParameterItem/1.0", "name": "select_time_range", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 86400000 } }, { "id": "21aeafb7-3429-4c8c-b74b-d296f0ce22b2", "version": "KqlParameterItem/1.0", "name": "watchlist", "label": "Watchlist", "type": 2, "isRequired": true, "quote": "'", "delimiter": ",", "query": "DataminrPulseCyberAlerts\r\n| mv-expand todynamic(WatchlistsMatchedByType)\r\n| where isnotempty(WatchlistsMatchedByType[\"name\"])\r\n| distinct tostring(WatchlistsMatchedByType[\"name\"])", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "select_time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Help", "expandable": true, "items": [ { "type": 1, "content": { "json": "This dashboards shows high level analytics about the Dataminr alerts from the selected Watchlist." }, "name": "text - 0" } ] }, "name": "Help" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| where ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}')) and isnotempty(AlertType)\r\n| summarize distinct_count=dcount(AlertId) by AlertType\r\n| sort by distinct_count desc", "size": 0, "showAnalytics": true, "title": "Alerts by Type", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "select_time_range", "showRefreshButton": true, "exportFieldName": "x", "exportParameterName": "alert_type", "exportDefaultValue": "None", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "chartSettings": { "xAxis": "AlertType", "seriesLabelSettings": [ { "seriesName": "Urgent", "color": "orange" }, { "seriesName": "Alert", "color": "yellow" }, { "seriesName": "Flash", "color": "redBright" } ], "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "50", "name": "Alerts by Type", "styleSettings": { "padding": "24px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| where ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}'))\r\n| mv-expand todynamic(Company)\r\n| extend companyName = tostring(Company[\"name\"])\r\n| where isnotempty(Company)\r\n| summarize Count=dcount(AlertId) by companyName\r\n| sort by Count desc", "size": 3, "showAnalytics": true, "title": "Alerts by Company", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "select_time_range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "yAxis": [ "Count" ], "group": "companyName", "createOtherGroup": 10, "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "50", "name": "Alerts by Company", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on a bars in the above 'Alert by Type' chart to view more details_" }, "name": "text - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| where ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}'))\r\n and isnotempty(AlertType) and AlertType == '{alert_type}'\r\n| summarize count=dcount(AlertId) by AlertType", "size": 4, "showAnalytics": true, "title": "Selected Alerts Type Data", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "select_time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000 } }, "conditionalVisibility": { "parameterName": "alert_type", "comparison": "isNotEqualTo", "value": "None" }, "name": "query - 8", "styleSettings": { "showBorder": true } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "89d85ee2-81ec-42ed-bd7e-d8e7bcee1ab1", "version": "KqlParameterItem/1.0", "name": "Category_name", "label": "Category Name", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "DataminrPulseCyberAlerts \r\n| mv-expand todynamic(Category)\r\n| extend categories = tostring(Category[\"name\"])\r\n| where ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}')) and isnotempty(categories)\r\n| distinct categories\r\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "select_time_range", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts \r\n| mv-expand todynamic(Category)\r\n| extend Date = format_datetime(todatetime(TimeGenerated), 'yyyy-MM-dd'), CategoryName = tostring(Category[\"name\"])\r\n| where ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}')) and ('*' in ({Category_name}) or CategoryName in ({Category_name})) and isnotempty(CategoryName)\r\n| summarize Dcount=dcount(AlertId) by Date, CategoryName\r\n| project Date, Dcount, CategoryName\r\n| order by Date asc", "size": 0, "aggregation": 5, "showAnalytics": true, "title": "Alerts Trend", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "select_time_range", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "x", "parameterName": "date_Occurrence_Trend", "parameterType": 1, "defaultValue": "None" }, { "fieldName": "series", "parameterName": "CategoryName_Occurrence_Trend", "parameterType": 1, "defaultValue": "None" } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "xAxis": "Date", "group": "CategoryName", "createOtherGroup": 99, "showDataPoints": true } }, "customWidth": "50", "name": "Alerts Trend", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| where ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}')) and isnotempty(EventLocationName) and isnotempty(WatchlistsMatchedByType)\r\n| summarize dcount=dcount(AlertId) by Latitude, Longitude, EventLocationName\r\n| extend latlng = strcat(\"Latitude : \",Latitude,\"\\nLongitude : \",Longitude,\"\\nName : \",EventLocationName,\"\\nCount : \",dcount)\r\n| order by dcount desc", "size": 0, "showAnalytics": true, "title": "Alerts by Location", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "select_time_range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "map", "graphSettings": { "type": 0, "topContent": { "columnMatch": "lat", "formatter": 1 }, "centerContent": { "columnMatch": "countID", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "mapSettings": { "locInfo": "LatLong", "latitude": "Latitude", "longitude": "Longitude", "sizeSettings": "dcount", "sizeAggregation": "Sum", "labelSettings": "latlng", "legendMetric": "dcount", "numberOfMetrics": 99, "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "dcount", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "50", "name": "Alerts by Location", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on a data points in the above 'Alerts Trend' chart to view more details_" }, "customWidth": "45", "name": "text - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts \r\n| extend TimeGenerated = tostring(TimeGenerated), Channel = substring(SourceChannels,1,strlen(SourceChannels)-2), category = parse_json(Category), embededLabels = parse_json(EmbeddedLabels)\r\n| mv-apply category on (summarize Topics = make_list(category.name))\r\n| mv-apply embededLabels on (summarize addresses = make_list(embededLabels.addresses))\r\n| extend CategoryName = array_index_of(Topics,'{CategoryName_Occurrence_Trend}'), Date = format_datetime(todatetime(TimeGenerated), 'yyyy-MM-dd')\r\n| where TimeGenerated contains '{date_Occurrence_Trend}' and CategoryName >= 0 and ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}'))\r\n| summarize any(*) by AlertId, Date\r\n| project-rename [\"Alert ID\"] = AlertId, [\"Alert Type\"] = any_AlertType, [\"Category Names\"] = any_Topics, Companies = any_Company, [\"Cyber Addresses\"] = any_addresses, [\"Location Name\"] = any_EventLocationName, [\"Matched Watchlist\"] = any_WatchlistNames, Source = any_EventSource, [\"Source Channels\"]= any_Channel, [\"Publisher Name\"] = any_PublisherCategoryName, [\"Time Generated\"] = any_TimeGenerated, Caption = any_Caption\r\n| project [\"Alert ID\"], [\"Alert Type\"], Caption, [\"Category Names\"], Companies, [\"Cyber Addresses\"], [\"Location Name\"], format_datetime(todatetime([\"Time Generated\"]), 'yy-MM-dd HH:mm:ss'), [\"Matched Watchlist\"], Source, parse_json([\"Source Channels\"]), [\"Publisher Name\"]\r\n| sort by [\"Time Generated\"] asc", "size": 0, "showAnalytics": true, "title": "Selected Alerts Trend Data", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "select_time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true }, "sortBy": [] }, "conditionalVisibilities": [ { "parameterName": "date_Occurrence_Trend", "comparison": "isNotEqualTo", "value": "None" }, { "parameterName": "CategoryName_Occurrence_Trend", "comparison": "isNotEqualTo", "value": "None" }, { "parameterName": "CategoryName_Occurrence_Trend", "comparison": "isNotEqualTo", "value": "Other" } ], "name": "query - 7", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| where ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}'))\r\n| extend EventTime = unixtime_milliseconds_todatetime(toint(EventTime)), Channel = substring(SourceChannels,1,strlen(SourceChannels)-2)\r\n| summarize any(*) by AlertId\r\n| project-rename ['Alert ID'] = AlertId, Time = any_TimeGenerated, [\"Alert Type\"] = any_AlertType, Source = any_EventSource, [\"Source Channels\"]= any_Channel, Publisher = any_PublisherCategoryName, Caption = any_Caption, Company = any_CompanyNames, Topics = any_CategoryNames\r\n| project ['Alert ID'], format_datetime(todatetime(Time), 'yy-MM-dd HH:mm:ss'), [\"Alert Type\"], Caption, Company, Source, parse_json([\"Source Channels\"]), Publisher, Topics\r\n| order by Time desc\r\n| limit 10", "size": 3, "showAnalytics": true, "title": "Recent 10 Alerts", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "select_time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Alert ID", "formatter": 7, "formatOptions": { "linkTarget": "GenericDetails", "linkIsContextBlade": true } } ], "filter": true }, "sortBy": [] }, "name": "Recent 10 Alerts", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "📝 ***Refresh the web page to fetch details of recently collected events***" }, "name": "text - 13" } ] }, "conditionalVisibility": { "parameterName": "setTab", "comparison": "isEqualTo", "value": "Alert Overview" }, "name": "group - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Dataminr Close Proximity Overview\r\n### Show Dataminr alerts in close proximity of important Customer locations" }, "name": "text - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "7b8368ba-ff5f-4cc6-a7b3-4bc4a7c00789", "version": "KqlParameterItem/1.0", "name": "Select_Time_Range", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Help", "expandable": true, "items": [ { "type": 1, "content": { "json": "This dashboards shows Dataminr alerts within threshold miles from important customer locations.\r\n\r\nThe important customer locations are configured as part of Sentinel Watchlist. The Watchlist file is included as part of this app.\r\n\r\nPlease update the Watchlist file manually." }, "name": "text - 0" } ] }, "name": "group - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "_GetWatchlist('DataminrPulseAsset')\r\n| extend crossjoin = 1\r\n| join kind=inner (DataminrPulseAlerts | extend crossjoin = 1) on crossjoin\r\n| extend asset_distance_miles = abs(3956 * (2 * asin(sqrt(pow(sin(((Latitude*pi()/180)-(todouble(asset_lat)*pi()/180)) / 2),2) + cos((Latitude*pi()/180)) * cos((todouble(asset_lat)*pi()/180)) * pow(sin(((Longitude*pi()/180)-(todouble(asset_long)*pi()/180)) / 2),2)))))\r\n| where asset_distance_miles <= toreal(alerting_distance_miles)\r\n| summarize any(asset_name), dcount=dcount(AlertId) by AlertId, tostring(asset_lat), tostring(asset_long)\r\n| extend latlng = strcat(\"Name : \",any_asset_name,\"\\nLatitude : \",asset_lat,\"\\nLongitude: \",asset_long)\r\n| order by asset_lat desc\r\n", "size": 0, "showAnalytics": true, "title": "Alerts in Close Proximity Map", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "Select_Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "map", "graphSettings": { "type": 0, "topContent": { "columnMatch": "AlertId", "formatter": 1 }, "centerContent": { "columnMatch": "dcount", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "mapSettings": { "locInfo": "LatLong", "latitude": "asset_lat", "longitude": "asset_long", "sizeSettings": "dcount", "sizeAggregation": "Sum", "labelSettings": "latlng", "legendMetric": "dcount", "numberOfMetrics": 0, "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "dcount", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "50", "showPin": false, "name": "Alerts in Close Proximity Map", "styleSettings": { "padding": "20px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "_GetWatchlist('DataminrPulseAsset')\r\n| extend crossjoin = 1\r\n| join kind=inner (DataminrPulseAlerts | extend crossjoin = 1) on crossjoin\r\n| extend asset_distance_miles = abs(3956 * (2 * asin(sqrt(pow(sin(((Latitude*pi()/180)-(todouble(asset_lat)*pi()/180)) / 2),2) + cos((Latitude*pi()/180)) * cos((todouble(asset_lat)*pi()/180)) * pow(sin(((Longitude*pi()/180)-(todouble(asset_long)*pi()/180)) / 2),2)))))\r\n| where asset_distance_miles <= toreal(alerting_distance_miles)\r\n| project-rename [\"Asset Name\"] = asset_name, [\"Asset Type\"] = asset_type, [\"Alert ID\"] = AlertId, [\"Asset Distance Miles\"] = asset_distance_miles\r\n| project [\"Asset Name\"], [\"Asset Type\"], Caption, [\"Alert ID\"], [\"Asset Distance Miles\"]\r\n", "size": 0, "showAnalytics": true, "title": " Alerts in Close Proximity", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "Select_Time_Range", "showRefreshButton": true, "exportFieldName": "Alert ID", "exportParameterName": "alertid", "exportDefaultValue": "None", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "showExpandCollapseGrid": true, "gridSettings": { "rowLimit": 10000, "filter": true }, "sortBy": [] }, "customWidth": "50", "name": "Alerts in Close Proximity", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "" }, "customWidth": "50", "name": "text - 7" }, { "type": 1, "content": { "json": "💡 _Click on a row in the above 'Alerts in Close Proximity' grid to view more details_" }, "customWidth": "50", "name": "text - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseAlerts\r\n| where AlertId == '{alertid}'", "size": 4, "showAnalytics": true, "title": "Selected Close Proximity Alert Data", "timeContextFromParameter": "Select_Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "conditionalVisibility": { "parameterName": "alertid", "comparison": "isNotEqualTo", "value": "None" }, "name": "query - 5", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "_GetWatchlist('DataminrPulseAsset')\r\n| project-rename [\"Asset Name\"] = asset_name, [\"Asset Type\"] = asset_type, [\"Asset Description\"] = asset_description, [\"Alerting Distance Miles\"] = alerting_distance_miles, [\"Asset Latitude\"] = asset_lat, [\"Asset Longitude\"] = asset_long\r\n| project [\"Asset Name\"], [\"Asset Type\"], [\"Asset Description\"], [\"Alerting Distance Miles\"], [\"Asset Latitude\"], [\"Asset Longitude\"]\r\n", "size": 0, "showAnalytics": true, "title": "Configured Important Locations", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "Select_Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "Asset Latitude", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "Asset Latitude", "sortOrder": 1 } ] }, "name": "Configured Important Locations", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "📝 ***Refresh the web page to fetch details of recently collected events***" }, "name": "text - 9" } ] }, "conditionalVisibility": { "parameterName": "setTab", "comparison": "isEqualTo", "value": "Close Proximity Overview" }, "name": "Close Proximity Overview" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Dataminr IOC Overview\r\n### IOCs (IP, URL, domain, hashes, filenames) extracted from alerts created by Dataminr" }, "showPin": false, "name": "text - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "4889f111-32cd-4a9f-8ad3-3d5a1a43d812", "version": "KqlParameterItem/1.0", "name": "time", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Help", "expandable": true, "items": [ { "type": 1, "content": { "json": "This dashboards shows Indicator of Compromise in the current Sentinel environment.\r\n\r\nEach row in the panels showing vulnerable IOCs are clickable. Click the row to view more details about the vulnerable IOC.\r\n\r\n" }, "name": "text - 0" } ] }, "name": "group - 14" }, { "type": 1, "content": { "json": "#### 📝 Note: To view the Affected IOCs related panles in this dashboard, ASim parsers must be deployed in the workspace and lookup csv data must be available in watchlist. " }, "name": "text - 21" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true\r\n(ASimNetworkSession\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | summarize src_ip = make_set(SrcIpAddr), dst_ip = make_set(DstIpAddr)\r\n | summarize ip = make_set(set_union(src_ip, dst_ip))),\r\n(ASimDns\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | summarize src_ip = make_set(SrcIpAddr), dst_ip = make_set(DstIpAddr)\r\n | summarize ip = make_set(set_union(src_ip, dst_ip))),\r\n(ASimWebSession\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | summarize src_ip = make_set(SrcIpAddr), dst_ip = make_set(DstIpAddr)\r\n | summarize ip = make_set(set_union(src_ip, dst_ip))),\r\n(ASimAuditEvent\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | summarize src_ip = make_set(SrcIpAddr), dst_ip = make_set(TargetIpAddr)\r\n | summarize ip = make_set(set_union(src_ip, dst_ip)))\r\n| mv-expand ip\r\n| where isnotempty(ip)\r\n| extend ip = tostring(ip)\r\n| join kind=inner (_GetWatchlist(\"DataminrPulseVulnerableIp\")\r\n | project ip, caption) on ip\r\n| project-rename [\"ASIM Ip\"] = ip, [\"Lookup Ip\"] = ip1\r\n| summarize ip_count=dcount([\"ASIM Ip\"])\r\n| project ip_count", "size": 4, "showAnalytics": true, "title": "Affected IP Address", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 12, "formatOptions": { "palette": "none" } }, "rightContent": { "columnMatch": "ip_count", "formatter": 12, "formatOptions": { "palette": "none" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" }, "emptyValCustomText": "0" } }, "showBorder": false, "size": "auto" }, "graphSettings": { "type": 0, "topContent": {}, "centerContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "none" } }, "nodeIdField": "Count", "sourceIdField": "Count", "targetIdField": "Count", "graphOrientation": 3, "showOrientationToggles": false, "nodeSize": null, "staticNodeSize": 100, "colorSettings": null, "hivesMargin": 5 }, "textSettings": { "style": "bignumber" } }, "customWidth": "25", "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true\r\n(imFileEvent\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | summarize src_md5=make_set(SrcFileMD5), src_sha1=make_set(SrcFileSHA1), src_sha256=make_set(SrcFileSHA256), src_sha512=make_set(SrcFileSHA512), dst_md5=make_set(TargetFileMD5), dst_sha1=make_set(TargetFileSHA1), dst_sha256=make_set(TargetFileSHA256), dst_sha512=make_set(TargetFileSHA512)\r\n | summarize Hashes = make_set(set_union(src_md5, src_sha1, src_sha256, src_sha512, dst_md5, dst_sha1, dst_sha256, dst_sha512))\r\n | project Hashes),\r\n(ASimProcessEvent\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | summarize src_md5=make_set(ParentProcessMD5), src_sha1=make_set(ParentProcessSHA1), src_sha256=make_set(ParentProcessSHA256), src_sha512=make_set(ParentProcessSHA512), dst_md5=make_set(TargetProcessMD5), dst_sha1=make_set(TargetProcessSHA1), dst_sha256=make_set(TargetProcessSHA256), dst_sha512=make_set(TargetProcessSHA512), act_md5 = make_set(ActingProcessMD5), act_sha1=make_set(ActingProcessSHA1), act_sha256=make_set(ActingProcessSHA256), act_sha512=make_set(ActingProcessSHA512)\r\n | summarize Hashes = make_set(set_union(src_md5, src_sha1, src_sha256, src_sha512, dst_md5, dst_sha1, dst_sha256, dst_sha512, act_md5, act_sha1, act_sha256, act_sha512))\r\n | project Hashes),\r\n(ASimWebSession\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | summarize file_md5=make_set(FileMD5), file_sha1=make_set(FileSHA1), file_sha256=make_set(FileSHA256), file_sha512=make_set(FileSHA512)\r\n | summarize Hashes = make_set(set_union(file_md5, file_sha1, file_sha256, file_sha512))\r\n | project Hashes)\r\n| mv-expand Hashes\r\n| where isnotempty(Hashes)\r\n| extend Hashes = tostring(Hashes)\r\n| join kind=inner (_GetWatchlist('DataminrPulseVulnerableHash')\r\n | project Hashes=SearchKey, caption) on Hashes\r\n| project-rename [\"ASIM Hashes\"] = Hashes, [\"Lookup Hashes\"] = Hashes1\r\n| summarize hash_count = dcount([\"ASIM Hashes\"])\r\n| project hash_count", "size": 4, "showAnalytics": true, "title": "Affected Hashes", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 12, "formatOptions": { "palette": "none" } }, "rightContent": { "columnMatch": "hash_count", "formatter": 12, "formatOptions": { "palette": "none" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" }, "emptyValCustomText": "0" } }, "showBorder": false, "size": "auto" } }, "customWidth": "25", "name": "query - 2 - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true\r\n(ASimWebSession\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | project url=Url),\r\n(imFileEvent\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | project url = TargetUrl),\r\n(ASimAuditEvent\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | project url = TargetUrl)\r\n| join kind=inner (_GetWatchlist('DataminrPulseVulnerableDomain')\r\n | project url, caption) on url\r\n| project-rename [\"ASIM URLs\"] = url, [\"Lookup URLs\"] = url1\r\n| summarize domain_count=dcount([\"ASIM URLs\"])\r\n| project domain_count", "size": 4, "showAnalytics": true, "title": "Affected Domains", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 12, "formatOptions": { "palette": "none" } }, "rightContent": { "columnMatch": "domain_count", "formatter": 12, "formatOptions": { "palette": "none" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" }, "emptyValCustomText": "0" } }, "showBorder": false, "size": "auto" } }, "customWidth": "25", "name": "query - 2 - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true\r\n(ASimAuditEvent\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | extend malware = ThreatName\r\n | project malware),\r\n(ASimNetworkSession\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | extend malware = ThreatName\r\n | project malware),\r\n(ASimDns\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | extend malware = ThreatName\r\n | project malware),\r\n(ASimWebSession\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | extend malware = ThreatName\r\n | project malware)\r\n| join kind=inner (_GetWatchlist('DataminrPulseVulnerableMalware')\r\n | project malware, caption) on malware\r\n| project-rename [\"ASIM Malwares\"] = malware, [\"Lookup Hashes\"] = malware1\r\n| summarize malware_count= dcount([\"ASIM Malwares\"])\r\n| project malware_count", "size": 4, "showAnalytics": true, "title": "Affected Malwares", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 12, "formatOptions": { "palette": "none" } }, "rightContent": { "columnMatch": "malware_count", "formatter": 12, "formatOptions": { "palette": "none" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" }, "emptyValCustomText": "0" } }, "showBorder": false, "size": "auto" } }, "customWidth": "25", "name": "query - 2 - Copy - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true\r\n(ASimNetworkSession\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | extend ip = pack_array(SrcIpAddr, DstIpAddr)\r\n | project ip, EventSchema, EventVendor, EventProduct, TimeGenerated, EventSeverity, EventType),\r\n(ASimDns\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | extend ip = pack_array(SrcIpAddr, DstIpAddr)\r\n | project ip, EventSchema, EventVendor, EventProduct, TimeGenerated, EventSeverity, EventType),\r\n(ASimWebSession\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | extend ip = pack_array(SrcIpAddr, DstIpAddr)\r\n | project ip, EventSchema, EventVendor, EventProduct, TimeGenerated, EventSeverity, EventType),\r\n(ASimAuditEvent\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | extend ip = pack_array(SrcIpAddr, TargetIpAddr)\r\n | project ip, EventSchema, EventVendor, EventProduct, TimeGenerated, EventSeverity, EventType)\r\n| mv-expand ip\r\n| where isnotempty(ip)\r\n| extend ip = tostring(ip)\r\n| join kind=inner (_GetWatchlist(\"DataminrPulseVulnerableIp\")\r\n | project ip, caption) on ip\r\n| project [\"Ip Addresses\"]=ip, EventSchema, EventVendor, EventProduct, TimeGenerated, EventSeverity, EventType, caption", "size": 0, "showAnalytics": true, "title": "Affected IP Address Details", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "customWidth": "25", "name": "query - 17", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true\r\n (imFileEvent\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | extend Hashes = pack_array(SrcFileMD5, SrcFileSHA1, SrcFileSHA256, SrcFileSHA512, TargetFileMD5, TargetFileSHA1, TargetFileSHA256, TargetFileSHA512)\r\n | project Hashes, EventSchema, EventVendor, EventProduct, EventSeverity, EventType),\r\n (ASimProcessEvent\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | extend Hashes= pack_array(ParentProcessMD5, ParentProcessSHA1, ParentProcessSHA256, ParentProcessSHA512, ActingProcessMD5, ActingProcessSHA1, ActingProcessSHA256, ActingProcessSHA512, TargetProcessMD5, TargetProcessSHA1, TargetProcessSHA256, TargetProcessSHA512)\r\n | project Hashes, EventSchema, EventVendor, EventProduct, EventSeverity, EventType ),\r\n (ASimWebSession\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | extend Hashes = pack_array(FileMD5, FileSHA1, FileSHA256, FileSHA512)\r\n | project Hashes, EventSchema, EventVendor, EventProduct, EventSeverity, EventType)\r\n| mv-expand todynamic(Hashes)\r\n| where isnotempty(Hashes)\r\n| extend Hashes = tostring(Hashes)\r\n| join kind=inner (_GetWatchlist('DataminrPulseVulnerableHash')\r\n | project Hashes=SearchKey, caption) on Hashes\r\n| project Hashes, EventSchema, EventVendor, EventProduct, EventSeverity, EventType, caption", "size": 0, "showAnalytics": true, "title": "Affected Hashes Details", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "customWidth": "25", "name": "query - 17 - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true\r\n (ASimWebSession\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | extend url=Url\r\n | project url, EventSchema, EventVendor, EventProduct, TimeGenerated, EventSeverity, EventType),\r\n (imFileEvent\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | extend url = TargetUrl\r\n | project url, EventSchema, EventVendor, EventProduct, TimeGenerated, EventSeverity, EventType),\r\n (ASimAuditEvent\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | extend url = TargetUrl\r\n | project url, EventSchema, EventVendor, EventProduct, TimeGenerated, EventSeverity, EventType)\r\n| where isnotempty(url)\r\n| join kind=inner (_GetWatchlist('DataminrPulseVulnerableDomain')\r\n | project url, caption) on url\r\n| project URL=url, EventSchema, EventVendor, EventProduct, TimeGenerated, EventSeverity, EventType", "size": 0, "showAnalytics": true, "title": "Affected Domains Details", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "customWidth": "25", "name": "query - 17 - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true\r\n (ASimAuditEvent\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | extend malware = ThreatName\r\n | project malware, EventSchema, EventVendor, EventProduct, TimeGenerated, EventSeverity, EventType),\r\n (ASimNetworkSession\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | extend malware = ThreatName\r\n | project malware, EventSchema, EventVendor, EventProduct, TimeGenerated, EventSeverity, EventType),\r\n (ASimDns\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | extend malware = ThreatName\r\n | project malware, EventSchema, EventVendor, EventProduct, TimeGenerated, EventSeverity, EventType),\r\n (ASimWebSession\r\n | where EventVendor !contains_cs(\"Dataminr\")\r\n | extend malware = ThreatName\r\n | project malware, EventSchema, EventVendor, EventProduct, TimeGenerated, EventSeverity, EventType)\r\n| where isnotempty(malware) \r\n| join kind=inner (_GetWatchlist('DataminrPulseVulnerableMalware')\r\n | project malware, caption) on malware\r\n| project malware, EventSchema, EventVendor, EventProduct, TimeGenerated, EventSeverity, EventType", "size": 0, "showAnalytics": true, "title": "Affected Malwares Details", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "customWidth": "25", "name": "query - 17 - Copy - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| extend embededLabels = parse_json(EmbeddedLabels)\r\n| mv-apply embededLabels on (summarize addresses = make_list(embededLabels.data.addresses))\r\n| mv-apply addresses on (summarize ip = make_list(addresses.ip))\r\n| where isnotempty(ip)\r\n| mv-expand ip\r\n| summarize Count=count_distinct(AlertId) by tostring(ip)\r\n| project-rename [\"IP Addresses\"] = ip\r\n| order by Count desc", "size": 0, "showAnalytics": true, "title": "Dataminr: Vulnerable IP Addresses", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "exportFieldName": "IP Addresses", "exportParameterName": "SelectedIP", "exportDefaultValue": "none", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "IP Addresses", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "85%" } }, { "columnMatch": "Count", "formatter": 4, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "15%" } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "25", "name": "query - 6", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| extend embededLabels = parse_json(EmbeddedLabels)\r\n| mv-apply embededLabels on (summarize hashValues = make_list(embededLabels.data.hashValues))\r\n| mv-apply hashValues on (summarize Hash=make_list(hashValues.value))\r\n| where isnotempty(Hash)\r\n| mv-expand Hash\r\n| summarize Count=count_distinct(AlertId) by tostring(Hash)\r\n| order by Count desc", "size": 0, "showAnalytics": true, "title": "Dataminr: Vulnerable Hashes", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "exportFieldName": "Hash", "exportParameterName": "SelectedHash", "exportDefaultValue": "none", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Hash", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "85%" } }, { "columnMatch": "Count", "formatter": 4, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "15%" } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "25", "name": "query - 6 - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| extend embededLabels = parse_json(EmbeddedLabels)\r\n| mv-apply embededLabels on (summarize urls = make_list(embededLabels.data.URLs))\r\n| where isnotempty(urls)\r\n| extend Domain = extract_all(@'\\\"?(?:[^\"]*https*:\\/\\/)*((w*\\.))*((?P[a-z-A-Z0-9-]+)\\.)*(?P(?:\\w+(?:\\.|\\[\\.\\])(?:com|co|org|gov|int|edu|mil|net)(?:(?:\\.|\\[\\.\\])\\w{1,3})*)|\\d+(?:(?:\\.|\\[\\.\\])\\d+){2}|[a-z-A-Z0-9-]+(?:\\.|\\[\\.\\])\\w+)(?:\\/[^\"]*)*\\\"?[,\\n\\]]',dynamic(['domain']),tostring(urls))\r\n| where isnotempty(Domain)\r\n| mv-expand Domain\r\n| summarize Count=count_distinct(AlertId) by tostring(Domain)\r\n| mv-expand todynamic(Domain)\r\n| order by Count desc", "size": 0, "showAnalytics": true, "title": "Dataminr: Vulnerable Domains", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "exportFieldName": "Domain", "exportParameterName": "SelectedDomain", "exportDefaultValue": "none", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Domain", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "85%" } }, { "columnMatch": "Count", "formatter": 4, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "15%" } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "25", "name": "query - 6 - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| extend embededLabels = parse_json(EmbeddedLabels)\r\n| mv-apply embededLabels on (summarize Malware = make_list(embededLabels.data.malwares))\r\n| where isnotempty(Malware)\r\n| mv-expand Malware\r\n| summarize Count=count_distinct(AlertId) by tostring(Malware)\r\n| order by Count desc", "size": 0, "showAnalytics": true, "title": "Dataminr: Vulnerable Malwares", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "exportFieldName": "Malware", "exportParameterName": "SelectedMalware", "exportDefaultValue": "none", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Malware", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "85%" } }, { "columnMatch": "Count", "formatter": 4, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "15%" } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "25", "name": "query - 6 - Copy - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on a row in the above 'Dataminr: Vulnerable IP Addresses', 'Dataminr: Vulnerable Hashes', 'Dataminr: Vulnerable Domains' & 'Dataminr: Vulnerable Malwares' grid to view more details_" }, "name": "text - 15" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| extend embededLabels = parse_json(EmbeddedLabels)\r\n| mv-apply embededLabels on (summarize addresses = make_list(embededLabels.data.addresses))\r\n| where addresses contains_cs '{SelectedIP}'\r\n| project [\"Alert ID\"]=AlertId, [\"Alert Type\"]=AlertType, Caption, [\"Category Names\"]=CategoryNames, Companies=Company, [\"Cyber Addresses\"]=addresses, [\"Location Name\"]=EventLocationName, TimeGenerated, [\"Matched Watchlist\"]=WatchlistNames, Source=EventSource\r\n| order by [\"Alert Type\"] asc", "size": 0, "showAnalytics": true, "title": "Dataminr: Vulnerable IP Details", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "SelectedIP", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 10", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| extend embededLabels = parse_json(EmbeddedLabels)\r\n| mv-apply embededLabels on (summarize hashValues = make_list(embededLabels.data.hashValues))\r\n| mv-apply hashValues on (summarize Hash=make_list(hashValues.value))\r\n| where set_has_element(Hash, '{SelectedHash}')\r\n| project [\"Alert ID\"]=AlertId, [\"Alert Type\"]=AlertType, Caption, [\"Category Names\"]=CategoryNames, Companies=Company, [\"Cyber Hashes\"]=Hash, [\"Location Name\"]=EventLocationName, TimeGenerated, [\"Matched Watchlist\"]=WatchlistNames, Source=EventSource\r\n| order by [\"Alert Type\"] asc", "size": 0, "showAnalytics": true, "title": "Dataminr: Vulnerable Hash Details", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "SelectedHash", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 10 - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| extend embededLabels = parse_json(EmbeddedLabels)\r\n| mv-apply embededLabels on (summarize urls = make_list(embededLabels.data.URLs))\r\n| where isnotempty(urls)\r\n| extend Domain = extract_all(@'\\\"?(?:[^\"]*https*:\\/\\/)*((w*\\.))*((?P[a-z-A-Z0-9-]+)\\.)*(?P(?:\\w+(?:\\.|\\[\\.\\])(?:com|co|org|gov|int|edu|mil|net)(?:(?:\\.|\\[\\.\\])\\w{1,3})*)|\\d+(?:(?:\\.|\\[\\.\\])\\d+){2}|[a-z-A-Z0-9-]+(?:\\.|\\[\\.\\])\\w+)(?:\\/[^\"]*)*\\\"?[,\\n\\]]',dynamic(['domain']),tostring(urls))\r\n| where Domain contains_cs '{SelectedDomain}'\r\n| project [\"Alert ID\"]=AlertId, [\"Alert Type\"]=AlertType, Caption, [\"Category Names\"]=CategoryNames, Companies=Company, URL=urls, [\"Location Name\"]=EventLocationName, TimeGenerated, [\"Matched Watchlist\"]=WatchlistNames, Source=EventSource\r\n| order by [\"Alert Type\"] asc", "size": 0, "showAnalytics": true, "title": "Dataminr: Vulnerable Domain Details", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "SelectedDomain", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 10 - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| extend embededLabels = parse_json(EmbeddedLabels)\r\n| mv-apply embededLabels on (summarize Malwares = make_list(embededLabels.data.malwares))\r\n| where set_has_element(Malwares, '{SelectedMalware}')\r\n| project [\"Alert ID\"]=AlertId, [\"Alert Type\"]=AlertType, Caption, [\"Category Names\"]=CategoryNames, Companies=Company, [\"Cyber Malwares\"]=Malwares, [\"Location Name\"]=EventLocationName, TimeGenerated, [\"Matched Watchlist\"]=WatchlistNames, Source=EventSource\r\n| order by [\"Alert Type\"] asc", "size": 0, "showAnalytics": true, "title": "Dataminr: Vulnerable Malware Details", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "SelectedMalware", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 10 - Copy - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "📝 ***Refresh the web page to fetch details of recently collected events***" }, "name": "text - 9" } ] }, "conditionalVisibility": { "parameterName": "setTab", "comparison": "isEqualTo", "value": "IOC Overview" }, "name": "group - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Dataminr Cyber Threat Overview\r\n### Cyber alerts created by Dataminr" }, "name": "text - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "e6627420-466f-4e23-ae50-7d153fe50b0c", "version": "KqlParameterItem/1.0", "name": "time", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let trendline=toscalar(DataminrPulseCyberAlerts\r\n| mv-expand todynamic(Category)\r\n| extend selectedTopic = Category[\"name\"]\r\n| where selectedTopic in (\"Advanced Persistent Threats\",\"Ransomware\",\"Hacktivists\") \r\n| extend selectedAllTopics = parse_json('[\"Advanced Persistent Threats\",\"Ransomware\",\"Hacktivists\"]')\r\n| make-series Trend = dcount(AlertId) default = 0 on TimeGenerated from {time:start} to {time:end} step {time:grain} by tostring(selectedAllTopics)\r\n| project Trend);\r\nDataminrPulseCyberAlerts\r\n| mv-expand todynamic(Category)\r\n| extend selectedTopic = Category[\"name\"]\r\n| where selectedTopic in (\"Advanced Persistent Threats\",\"Ransomware\",\"Hacktivists\")\r\n| summarize Count = dcount(AlertId) by tostring(selectedTopic), bin(TimeGenerated, 1d)\r\n| summarize total = sum(Count) by TimeGenerated\r\n| extend today = iff(TimeGenerated==(startofday(now())), total, 0)\r\n| extend yesterday = iff(TimeGenerated==(startofday(now())-1d), total, 0)\r\n| extend Trend = trendline\r\n| serialize\r\n| order by TimeGenerated desc\r\n| extend nextyesterday = iff((today == 0 and yesterday > 0), yesterday, iff(isempty(next(yesterday)), 0, next(yesterday)))\r\n| limit 1\r\n| extend percentage = (todouble(today-nextyesterday)/nextyesterday)*100", "size": 4, "showAnalytics": true, "title": "Threat Actor Activities", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 5 }, "leftContent": { "columnMatch": "today", "formatter": 12, "formatOptions": { "palette": "none" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" }, "emptyValCustomText": "0" } }, "rightContent": { "columnMatch": "percentage", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">", "thresholdValue": "0", "representation": "redBright", "text": "{0}{1}" }, { "operator": "<", "thresholdValue": "0", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "0", "representation": "gray", "text": "0" }, { "operator": "is Empty", "representation": "gray", "text": "N/A" }, { "operator": "Default", "thresholdValue": null, "representation": "redBright", "text": "N/A" } ] }, "numberFormat": { "unit": 1, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue" } }, "showBorder": false, "size": "full" } }, "customWidth": "25", "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let trendline=toscalar(DataminrPulseCyberAlerts\r\n| mv-expand todynamic(Category)\r\n| extend selectedTopic = Category[\"name\"]\r\n| where selectedTopic in (\"Malware\",\"Network Disruptions\",\"Phishing\",\"DDoS\",\"Defacement\",\"Domain Impersonation\",\"Network Scans\") \r\n| extend selectedAllTopics = parse_json('[\"Malware\",\"Network Disruptions\",\"Phishing\",\"DDoS\",\"Defacement\",\"Domain Impersonation\",\"Network Scans\"]')\r\n| make-series Trend = dcount(AlertId) default = 0 on TimeGenerated from {time:start} to {time:end} step {time:grain} by tostring(selectedAllTopics)\r\n| project Trend);\r\nDataminrPulseCyberAlerts\r\n| mv-expand todynamic(Category)\r\n| extend selectedTopic = Category[\"name\"]\r\n| where selectedTopic in (\"Malware\",\"Network Disruptions\",\"Phishing\",\"DDoS\",\"Defacement\",\"Domain Impersonation\",\"Network Scans\")\r\n| summarize Count = dcount(AlertId) by tostring(selectedTopic), bin(TimeGenerated, 1d)\r\n| summarize total = sum(Count) by TimeGenerated\r\n| extend today = iff(TimeGenerated==(startofday(now())), total, 0)\r\n| extend yesterday = iff(TimeGenerated==(startofday(now())-1d), total, 0)\r\n| extend Trend = trendline\r\n| serialize\r\n| order by TimeGenerated desc\r\n| extend nextyesterday = iff((today == 0 and yesterday > 0), yesterday, iff(isempty(next(yesterday)), 0, next(yesterday)))\r\n| limit 1\r\n| extend percentage = (todouble(today-nextyesterday)/nextyesterday)*100", "size": 4, "showAnalytics": true, "title": "Cyber Attacks", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 5 }, "leftContent": { "columnMatch": "today", "formatter": 12, "formatOptions": { "palette": "none" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" }, "emptyValCustomText": "0" } }, "rightContent": { "columnMatch": "percentage", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">", "thresholdValue": "0", "representation": "redBright", "text": "{0}{1}" }, { "operator": "<", "thresholdValue": "0", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "0", "representation": "gray", "text": "0" }, { "operator": "is Empty", "representation": "gray", "text": "N/A" }, { "operator": "Default", "thresholdValue": null, "representation": "redBright", "text": "N/A" } ] }, "numberFormat": { "unit": 1, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue" } }, "showBorder": false, "size": "full" } }, "customWidth": "25", "name": "query - 3", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let trendline=toscalar(DataminrPulseCyberAlerts\r\n| mv-expand todynamic(Category)\r\n| extend selectedTopic = Category[\"name\"]\r\n| where selectedTopic in (\"Data Exposure and Breaches\",\"Doxxing and Leaked Credentials\") \r\n| extend selectedAllTopics = parse_json('[\"Data Exposure and Breaches\",\"Doxxing and Leaked Credentials\"]')\r\n| make-series Trend = dcount(AlertId) default = 0 on TimeGenerated from {time:start} to {time:end} step {time:grain} by tostring(selectedAllTopics)\r\n| project Trend);\r\nDataminrPulseCyberAlerts\r\n| mv-expand todynamic(Category)\r\n| extend selectedTopic = Category[\"name\"]\r\n| where selectedTopic in (\"Data Exposure and Breaches\",\"Doxxing and Leaked Credentials\")\r\n| summarize Count = dcount(AlertId) by tostring(selectedTopic), bin(TimeGenerated, 1d)\r\n| summarize total = sum(Count) by TimeGenerated\r\n| extend today = iff(TimeGenerated==(startofday(now())), total, 0)\r\n| extend yesterday = iff(TimeGenerated==(startofday(now())-1d), total, 0)\r\n| extend Trend = trendline\r\n| serialize\r\n| order by TimeGenerated desc\r\n| extend nextyesterday = iff((today == 0 and yesterday > 0), yesterday, iff(isempty(next(yesterday)), 0, next(yesterday)))\r\n| limit 1\r\n| extend percentage = (todouble(today-nextyesterday)/nextyesterday)*100\r\n", "size": 4, "showAnalytics": true, "title": "Data Breaches", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 5 }, "leftContent": { "columnMatch": "today", "formatter": 12, "formatOptions": { "palette": "none" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" }, "emptyValCustomText": "0" } }, "rightContent": { "columnMatch": "percentage", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">", "thresholdValue": "0", "representation": "redBright", "text": "{0}{1}" }, { "operator": "<", "thresholdValue": "0", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "0", "representation": "gray", "text": "0" }, { "operator": "is Empty", "representation": "gray", "text": "N/A" }, { "operator": "Default", "thresholdValue": null, "representation": "redBright", "text": "N/A" } ] }, "numberFormat": { "unit": 1, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue" } }, "showBorder": false, "size": "full" } }, "customWidth": "25", "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let trendline=toscalar(DataminrPulseCyberAlerts\r\n| mv-expand todynamic(Category)\r\n| extend selectedTopic = Category[\"name\"]\r\n| where selectedTopic in (\"Email and Web Servers\",\"Encryption and Certificates\",\"Remote Access and Management Systems\",\"Vulnerability Disclosures\",\"Exploits\",\"Bug Bounties\") \r\n| extend selectedAllTopics = parse_json('[\"Email and Web Servers\",\"Encryption and Certificates\",\"Remote Access and Management Systems\",\"Vulnerability Disclosures\",\"Exploits\",\"Bug Bounties\"]')\r\n| make-series Trend = dcount(AlertId) default = 0 on TimeGenerated from {time:start} to {time:end} step {time:grain} by tostring(selectedAllTopics)\r\n| project Trend);\r\nDataminrPulseCyberAlerts\r\n| mv-expand todynamic(Category)\r\n| extend selectedTopic = Category[\"name\"]\r\n| where selectedTopic in (\"Email and Web Servers\",\"Encryption and Certificates\",\"Remote Access and Management Systems\",\"Vulnerability Disclosures\",\"Exploits\",\"Bug Bounties\")\r\n| summarize Count = dcount(AlertId) by tostring(selectedTopic), bin(TimeGenerated, 1d)\r\n| summarize total = sum(Count) by TimeGenerated\r\n| extend today = iff(TimeGenerated==(startofday(now())), total, 0)\r\n| extend yesterday = iff(TimeGenerated==(startofday(now())-1d), total, 0)\r\n| extend Trend = trendline\r\n| serialize\r\n| order by TimeGenerated desc\r\n| extend nextyesterday = iff((today == 0 and yesterday > 0), yesterday, iff(isempty(next(yesterday)), 0, next(yesterday)))\r\n| limit 1\r\n| extend percentage = (todouble(today-nextyesterday)/nextyesterday)*100", "size": 4, "showAnalytics": true, "title": "Vulnerabilities", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 5 }, "leftContent": { "columnMatch": "today", "formatter": 12, "formatOptions": { "palette": "none" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" }, "emptyValCustomText": "0" } }, "rightContent": { "columnMatch": "percentage", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">", "thresholdValue": "0", "representation": "redBright", "text": "{0}{1}" }, { "operator": "<", "thresholdValue": "0", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "0", "representation": "gray", "text": "0" }, { "operator": "is Empty", "representation": "gray", "text": "N/A" }, { "operator": "Default", "thresholdValue": null, "representation": "redBright", "text": "N/A" } ] }, "numberFormat": { "unit": 1, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue" } }, "showBorder": false, "size": "full" } }, "customWidth": "25", "name": "query - 5", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| mv-expand todynamic(Category)\r\n| extend selectedTopic = Category[\"name\"]\r\n| where selectedTopic in (\"Advanced Persistent Threats\",\"Ransomware\",\"Hacktivists\") \r\n| make-series Trend = dcount(AlertId) default = 0 on TimeGenerated from {time:start} to {time:end} step {time:grain} by tostring(selectedTopic)\r\n| project-away TimeGenerated\r\n| extend Count=array_sum(Trend)\r\n| project Topics=selectedTopic, Count, Trend\r\n| order by Count desc", "size": 0, "showAnalytics": true, "title": "Trending Threat Actor Activities", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "exportFieldName": "Topics", "exportParameterName": "ThreatActorselectedTopic", "exportDefaultValue": "none", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Topics", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "10%" } }, { "columnMatch": "Count", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "85%" } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "25", "name": "query - 6", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| mv-expand todynamic(Category)\r\n| extend selectedTopic = Category[\"name\"]\r\n| where selectedTopic in (\"Malware\",\"Network Disruptions\",\"Phishing\",\"DDoS\",\"Defacement\",\"Domain Impersonation\",\"Network Scans\") \r\n| make-series Trend = dcount(AlertId) default = 0 on TimeGenerated from {time:start} to {time:end} step {time:grain} by tostring(selectedTopic)\r\n| project-away TimeGenerated\r\n| extend Count=array_sum(Trend)\r\n| project Topics=selectedTopic, Count, Trend\r\n| order by Count desc", "size": 0, "showAnalytics": true, "title": "Trending Cyber Attacks", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "exportFieldName": "Topics", "exportParameterName": "CyberAttackselectedTopic", "exportDefaultValue": "none", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Topics", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "10%" } }, { "columnMatch": "Count", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "85%" } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "25", "name": "query - 7", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| mv-expand todynamic(Category)\r\n| extend selectedTopic = Category[\"name\"]\r\n| where selectedTopic in (\"Data Exposure and Breaches\",\"Doxxing and Leaked Credentials\") \r\n| make-series Trend = dcount(AlertId) default = 0 on TimeGenerated from {time:start} to {time:end} step {time:grain} by tostring(selectedTopic)\r\n| project-away TimeGenerated\r\n| extend Count=array_sum(Trend)\r\n| project Topics=selectedTopic, Count, Trend\r\n| order by Count desc ", "size": 0, "showAnalytics": true, "title": "Trending Data Breaches", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "exportFieldName": "Topics", "exportParameterName": "DataBreachselectedTopic", "exportDefaultValue": "none", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Topics", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "10%" } }, { "columnMatch": "Count", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "85%" } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "25", "name": "query - 8", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| mv-expand todynamic(Category)\r\n| extend selectedTopic = Category[\"name\"]\r\n| where selectedTopic in (\"Email and Web Servers\",\"Encryption and Certificates\",\"Remote Access and Management Systems\",\"Vulnerability Disclosures\",\"Exploits\",\"Bug Bounties\") \r\n| make-series Trend = count_distinct(AlertId) default = 0 on TimeGenerated from {time:start} to {time:end} step {time:grain} by tostring(selectedTopic)\r\n| project-away TimeGenerated\r\n| extend Count=array_sum(Trend)\r\n| project Topics=selectedTopic, Count, Trend\r\n| order by Count desc", "size": 0, "showAnalytics": true, "title": "Trending Vulnerabilities", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "exportFieldName": "Topics", "exportParameterName": "VulnerabilityselectedTopic", "exportDefaultValue": "none", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Topics", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "10%" } }, { "columnMatch": "Count", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "85%" } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "25", "name": "query - 9", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on a row in the above 'Trending Threat Actor Activities', 'Trending Cyber Attacks', 'Trending Data Breaches' & 'Trending Vulnerabilities' grid to view more details_" }, "name": "text - 26" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| mv-expand todynamic(Category), todynamic(EmbeddedLabels)\r\n| extend addresses = tostring(parse_json(EmbeddedLabels.data.addresses))\r\n| extend vulnerabilities = parse_json(EmbeddedLabels.data.vulnerabilities)\r\n| mv-apply vulnerabilities on (summarize vulnerabilitiesId = make_list(vulnerabilities.id))\r\n| extend selectedTopic = Category[\"name\"]\r\n| where selectedTopic == '{ThreatActorselectedTopic}'\r\n| summarize any(*) by AlertId\r\n| project [\"Alert ID\"]=AlertId, [\"Alert Post Link\"]=any_PostLink, [\"Alert Type\"]=any_AlertType, Caption=any_Caption, [\"Category Names\"]=any_CategoryNames, Companies=any_Company, [\"Cyber Addresses\"]=any_addresses, [\"Location Name\"]=any_EventLocationName, TimeGenerated=any_TimeGenerated, Source=any_EventSource, [\"Source Channels\"]=any_SourceChannels, [\"Vulnerability IDs\"]=any_vulnerabilitiesId\r\n", "size": 0, "showAnalytics": true, "title": "Selected Trending Threat Actor Activity Data", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "ThreatActorselectedTopic", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 18" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| mv-expand todynamic(Category), todynamic(EmbeddedLabels)\r\n| extend addresses = tostring(parse_json(EmbeddedLabels.data.addresses))\r\n| extend vulnerabilities = parse_json(EmbeddedLabels.data.vulnerabilities)\r\n| mv-apply vulnerabilities on (summarize vulnerabilitiesId = make_list(vulnerabilities.id))\r\n| extend selectedTopic = Category[\"name\"]\r\n| where selectedTopic == '{CyberAttackselectedTopic}'\r\n| summarize any(*)by AlertId\r\n| project [\"Alert ID\"]=AlertId, [\"Alert Post Link\"]=any_PostLink, [\"Alert Type\"]=any_AlertType, Caption=any_Caption, [\"Category Names\"]=any_CategoryNames, Companies=any_Company, [\"Cyber Addresses\"]=any_addresses, [\"Location Name\"]=any_EventLocationName, TimeGenerated=any_TimeGenerated, Source=any_EventSource, [\"Source Channels\"]=any_SourceChannels, [\"Vulnerability IDs\"]=any_vulnerabilitiesId", "size": 0, "showAnalytics": true, "title": "Selected Trending Cyber Attack Data", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "CyberAttackselectedTopic", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 19" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| mv-expand todynamic(Category), todynamic(EmbeddedLabels)\r\n| extend addresses = tostring(parse_json(EmbeddedLabels.data.addresses))\r\n| extend vulnerabilities = parse_json(EmbeddedLabels.data.vulnerabilities)\r\n| mv-apply vulnerabilities on (summarize vulnerabilitiesId = make_list(vulnerabilities.id))\r\n| extend selectedTopic = Category[\"name\"]\r\n| where selectedTopic == '{DataBreachselectedTopic}'\r\n| summarize any(*)by AlertId\r\n| project [\"Alert ID\"]=AlertId, [\"Alert Post Link\"]=any_PostLink, [\"Alert Type\"]=any_AlertType, Caption=any_Caption, [\"Category Names\"]=any_CategoryNames, Companies=any_Company, [\"Cyber Addresses\"]=any_addresses, [\"Location Name\"]=any_EventLocationName, TimeGenerated=any_TimeGenerated, Source=any_EventSource, [\"Source Channels\"]=any_SourceChannels, [\"Vulnerability IDs\"]=any_vulnerabilitiesId", "size": 0, "showAnalytics": true, "title": "Selected Trending Data Breach Data", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "DataBreachselectedTopic", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 20" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| mv-expand todynamic(Category), todynamic(EmbeddedLabels)\r\n| extend addresses = tostring(parse_json(EmbeddedLabels.data.addresses))\r\n| extend vulnerabilities = parse_json(EmbeddedLabels.data.vulnerabilities)\r\n| mv-apply vulnerabilities on (summarize vulnerabilitiesId = make_list(vulnerabilities.id))\r\n| extend selectedTopic = Category[\"name\"]\r\n| where selectedTopic == '{VulnerabilityselectedTopic}'\r\n| summarize any(*)by AlertId\r\n| project [\"Alert ID\"]=AlertId, [\"Alert Post Link\"]=any_PostLink, [\"Alert Type\"]=any_AlertType, Caption=any_Caption, [\"Category Names\"]=any_CategoryNames, Companies=any_Company, [\"Cyber Addresses\"]=any_addresses, [\"Location Name\"]=any_EventLocationName, TimeGenerated=any_TimeGenerated, Source=any_EventSource, [\"Source Channels\"]=any_SourceChannels, [\"Vulnerability IDs\"]=any_vulnerabilitiesId", "size": 0, "showAnalytics": true, "title": "Selected Trending Vulnerability Data", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "VulnerabilityselectedTopic", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 21" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| mv-expand todynamic(Category)\r\n| extend selectedTopic = Category[\"name\"]\r\n| where selectedTopic in (\"Advanced Persistent Threats\",\"Ransomware\",\"Hacktivists\")\r\n| project TimeGenerated, Caption, Topic=selectedTopic, Severity=AlertType, Source=EventSource, Company=CompanyNames, AlertId\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Threat Actor Activities", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "exportFieldName": "AlertId", "exportParameterName": "ThreatActorAlertId", "exportDefaultValue": "none", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "AlertId", "formatter": 5 } ], "rowLimit": 10000, "filter": true } }, "customWidth": "50", "name": "query - 10", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| mv-expand todynamic(Category)\r\n| extend selectedTopic = Category[\"name\"]\r\n| where selectedTopic in (\"Malware\",\"Network Disruptions\",\"Phishing\",\"DDoS\",\"Defacement\",\"Domain Impersonation\",\"Network Scans\")\r\n| project TimeGenerated, Caption, Topic=selectedTopic, Severity=AlertType, Source=EventSource, Company=CompanyNames, AlertId", "size": 0, "showAnalytics": true, "title": "Cyber Attacks", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "exportFieldName": "AlertId", "exportParameterName": "CyberAttackAlertId", "exportDefaultValue": "none", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "AlertId", "formatter": 5 } ], "rowLimit": 10000, "filter": true } }, "customWidth": "50", "name": "query - 11", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on a row in the above 'Threat Actor Activities' grid to view more details_" }, "customWidth": "50", "name": "text - 22" }, { "type": 1, "content": { "json": "💡 _Click on a row in the above 'Cyber Attacks' grid to view more details_" }, "customWidth": "50", "name": "text - 22 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| mv-expand todynamic(Category)\r\n| extend selectedTopic = Category[\"name\"]\r\n| where selectedTopic in (\"Data Exposure and Breaches\",\"Doxxing and Leaked Credentials\") \r\n| project TimeGenerated, Caption, Topic=selectedTopic, Severity=AlertType, Source=EventSource, Company=CompanyNames, AlertId", "size": 0, "showAnalytics": true, "title": "Data Breaches", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "exportFieldName": "AlertId", "exportParameterName": "DataBreachesAlertId", "exportDefaultValue": "none", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "AlertId", "formatter": 5 } ], "rowLimit": 10000, "filter": true } }, "customWidth": "50", "name": "query - 12", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| mv-expand todynamic(Category)\r\n| extend selectedTopic = Category[\"name\"]\r\n| where selectedTopic in (\"Email and Web Servers\",\"Encryption and Certificates\",\"Remote Access and Management Systems\",\"Vulnerability Disclosures\",\"Exploits\",\"Bug Bounties\")\r\n| project TimeGenerated, Caption, Topic=selectedTopic, Severity=AlertType, Source=EventSource, Company=CompanyNames, AlertId", "size": 0, "showAnalytics": true, "title": "Vulnerabilities", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "exportFieldName": "AlertId", "exportParameterName": "VulnerabilitiesAlertId", "exportDefaultValue": "none", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "AlertId", "formatter": 5 } ], "rowLimit": 10000, "filter": true } }, "customWidth": "50", "name": "query - 13", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on a row in the above 'Data Breaches' grid to view more details_" }, "customWidth": "50", "name": "text - 24" }, { "type": 1, "content": { "json": "💡 _Click on a row in the above 'Vulnerabilities' grid to view more details_" }, "customWidth": "50", "name": "text - 24 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| where AlertId == '{ThreatActorAlertId}'\r\n| mv-expand todynamic(Category), todynamic(EmbeddedLabels)\r\n| extend addresses = tostring(parse_json(EmbeddedLabels.data.addresses))\r\n| extend vulnerabilities = parse_json(EmbeddedLabels.data.vulnerabilities)\r\n| mv-apply vulnerabilities on (summarize vulnerabilitiesId = make_list(vulnerabilities.id))\r\n| extend selectedTopic = Category[\"name\"]\r\n| summarize any(*) by AlertId\r\n| project AlertId, [\"Alert Post Link\"]=any_PostLink, [\"Alert Type\"]=any_AlertType,Caption=any_Caption, [\"Category Names\"]=any_CategoryNames, Companies=any_Company, [\"Cyber Addresses\"]=any_addresses, [\"Location Name\"]=any_EventLocationName, TimeGenerated=any_TimeGenerated, [\"Matched Watchlist\"]=any_WatchlistNames, Source=any_EventSource, [\"Source Channels\"]=any_SourceChannels, [\"Vulnerability IDs\"]=any_vulnerabilitiesId", "size": 0, "showAnalytics": true, "title": "Selected Threat Actor Activity Data", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000 } }, "conditionalVisibility": { "parameterName": "ThreatActorAlertId", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 14" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| where AlertId == '{CyberAttackAlertId}'\r\n| mv-expand todynamic(Category), todynamic(EmbeddedLabels)\r\n| extend addresses = tostring(parse_json(EmbeddedLabels.data.addresses))\r\n| extend vulnerabilities = parse_json(EmbeddedLabels.data.vulnerabilities)\r\n| mv-apply vulnerabilities on (summarize vulnerabilitiesId = make_list(vulnerabilities.id))\r\n| extend selectedTopic = Category[\"name\"]\r\n| summarize any(*) by AlertId\r\n| project AlertId, [\"Alert Post Link\"]=any_PostLink, [\"Alert Type\"]=any_AlertType, Caption=any_Caption, [\"Category Names\"]=any_CategoryNames, Companies=any_Company, [\"Cyber Addresses\"]=any_addresses, [\"Location Name\"]=any_EventLocationName, TimeGenerated=any_TimeGenerated, [\"Matched Watchlist\"]=any_WatchlistNames, Source=any_EventSource, [\"Source Channels\"]=any_SourceChannels, [\"Vulnerability IDs\"]=any_vulnerabilitiesId", "size": 0, "showAnalytics": true, "title": "Selected Cyber Attack Data", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000 } }, "conditionalVisibility": { "parameterName": "CyberAttackAlertId", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 15" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| where AlertId == '{DataBreachesAlertId}'\r\n| mv-expand todynamic(Category), todynamic(EmbeddedLabels)\r\n| extend addresses = tostring(parse_json(EmbeddedLabels.data.addresses))\r\n| extend vulnerabilities = parse_json(EmbeddedLabels.data.vulnerabilities)\r\n| mv-apply vulnerabilities on (summarize vulnerabilitiesId = make_list(vulnerabilities.id))\r\n| extend selectedTopic = Category[\"name\"]\r\n| summarize any(*) by AlertId\r\n| project AlertId, [\"Alert Post Link\"]=any_PostLink, [\"Alert Type\"]=any_AlertType,Caption=any_Caption, [\"Category Names\"]=any_CategoryNames, Companies=any_Company, [\"Cyber Addresses\"]=any_addresses, [\"Location Name\"]=any_EventLocationName, TimeGenerated=any_TimeGenerated, [\"Matched Watchlist\"]=any_WatchlistNames, Source=any_EventSource, [\"Source Channels\"]=any_SourceChannels, [\"Vulnerability IDs\"]=any_vulnerabilitiesId", "size": 0, "showAnalytics": true, "title": "Selected Data Breach Data", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000 } }, "conditionalVisibility": { "parameterName": "DataBreachesAlertId", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 16" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseCyberAlerts\r\n| where AlertId == '{VulnerabilitiesAlertId}'\r\n| mv-expand todynamic(Category), todynamic(EmbeddedLabels)\r\n| extend addresses = tostring(parse_json(EmbeddedLabels.data.addresses))\r\n| extend vulnerabilities = parse_json(EmbeddedLabels.data.vulnerabilities)\r\n| mv-apply vulnerabilities on (summarize vulnerabilitiesId = make_list(vulnerabilities.id))\r\n| extend selectedTopic = Category[\"name\"]\r\n| summarize any(*) by AlertId\r\n| project AlertId, [\"Alert Post Link\"]=any_PostLink, [\"Alert Type\"]=any_AlertType,Caption=any_Caption, [\"Category Names\"]=any_CategoryNames, Companies=any_Company, [\"Cyber Addresses\"]=any_addresses, [\"Location Name\"]=any_EventLocationName, TimeGenerated=any_TimeGenerated, [\"Matched Watchlist\"]=any_WatchlistNames, Source=any_EventSource, [\"Source Channels\"]=any_SourceChannels, [\"Vulnerability IDs\"]=any_vulnerabilitiesId", "size": 0, "showAnalytics": true, "title": "Selected Vulnerability Data", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000 } }, "conditionalVisibility": { "parameterName": "VulnerabilitiesAlertId", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 17" }, { "type": 1, "content": { "json": "📝 ***Refresh the web page to fetch details of recently collected events***" }, "name": "text - 27" } ] }, "conditionalVisibility": { "parameterName": "setTab", "comparison": "isEqualTo", "value": "Cyber Threat Overview" }, "name": "group - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Dataminr Alerts Drilldown\r\n### An overview of your Dataminr alerts stored in Sentinel." }, "name": "text - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "c71807b7-f47d-48e8-8b38-13af8b856313", "version": "KqlParameterItem/1.0", "name": "time", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 86400000 } }, { "id": "7c5ac891-169b-4194-a76d-c05fe5e4a381", "version": "KqlParameterItem/1.0", "name": "location", "label": "Location", "type": 2, "isRequired": true, "quote": "'", "delimiter": ",", "query": "DataminrPulseAlerts\r\n| where TimeGenerated >=ago(90d)\r\n| distinct EventLocationName\r\n| where isnotempty(EventLocationName)\r\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "b565146d-68da-42cf-b6ab-b5bd6d426e05", "version": "KqlParameterItem/1.0", "name": "event_source", "label": "Source", "type": 2, "isRequired": true, "quote": "'", "delimiter": ",", "query": "DataminrPulseAlerts\r\n| where TimeGenerated >=ago(90d)\r\n| distinct EventSource\r\n| where isnotempty(EventSource)", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "020f92cc-41a5-4fc7-bd00-1c71460a169f", "version": "KqlParameterItem/1.0", "name": "company", "label": "Company", "type": 2, "isRequired": true, "quote": "'", "delimiter": ",", "query": "DataminrPulseAlerts\r\n| where TimeGenerated >=ago(90d)\r\n| mv-expand todynamic(Company)\r\n| distinct tostring(Company[\"name\"])", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "c103d8bb-76dc-42bf-a5da-f6b03bbda2d4", "version": "KqlParameterItem/1.0", "name": "severity", "label": "Severity", "type": 2, "isRequired": true, "quote": "'", "delimiter": ",", "query": "DataminrPulseAlerts\r\n| where TimeGenerated >=ago(90d)\r\n| distinct AlertType = case(isempty(AlertType), \"Unknown\", AlertType)", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "32f3344a-34e3-4d68-8c2b-ce82e707729e", "version": "KqlParameterItem/1.0", "name": "topic", "label": "Topic", "type": 2, "isRequired": true, "quote": "'", "delimiter": ",", "query": "DataminrPulseAlerts\r\n| where TimeGenerated >=ago(90d)\r\n| mv-expand todynamic(Category)\r\n| distinct tostring(Category[\"name\"])", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "232e3e4d-8112-4f65-ab5d-15bd4f18da9d", "version": "KqlParameterItem/1.0", "name": "watchlist", "label": "Watchlist", "type": 2, "isRequired": true, "quote": "'", "delimiter": ",", "query": "DataminrPulseAlerts\r\n| where TimeGenerated >=ago(90d)\r\n| mv-expand todynamic(WatchlistsMatchedByType)\r\n| distinct tostring(WatchlistsMatchedByType[\"name\"])", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "1a2c6025-a4fb-4002-9aa8-9254b1351bc0", "version": "KqlParameterItem/1.0", "name": "search_keyword", "label": "Keyword Search", "type": 1, "description": "Provide * for fetching All values", "isRequired": true, "value": "*" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseAlerts\r\n| where isnotempty(Latitude) and isnotempty(Longitude) \r\n and ('*' == ('{location}') or EventLocationName == ('{location}'))\r\n and ('*' == ('{event_source}') or EventSource == ('{event_source}'))\r\n and ('*' == ('{company}') or set_has_element(todynamic(CompanyNames),'{company}'))\r\n and ('*' == ('{severity}') or AlertType == ('{severity}'))\r\n and ('*' == ('{topic}') or set_has_element(todynamic(CategoryNames), '{topic}'))\r\n and ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}'))\r\n and ('{search_keyword:label}' == '*' or (* has '{search_keyword:label}'))\r\n| summarize any(EventLocationName), distinct_count=dcount(AlertId) by tostring(Latitude), tostring(Longitude)\r\n| extend latlng = strcat(\"Name: \",any_EventLocationName,\"\\nLatitude: \",Latitude,\"\\nLongitude: \",Longitude)\r\n| order by distinct_count desc", "size": 0, "showAnalytics": true, "title": "Alerts Location Map", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "map", "mapSettings": { "locInfo": "LatLong", "latitude": "Latitude", "longitude": "Longitude", "sizeSettings": "distinct_count", "sizeAggregation": "Sum", "labelSettings": "latlng", "legendMetric": "distinct_count", "numberOfMetrics": 0, "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "distinct_count", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" }, "numberFormatSettings": { "unit": 0, "options": { "style": "decimal" } } } }, "customWidth": "50", "name": "Alerts Location Map", "styleSettings": { "padding": "22px", "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseAlerts\r\n| where TimeGenerated >= ago(14d) and TimeGenerated <=ago(7d)\r\n| where ('*' == ('{location}') or EventLocationName == ('{location}'))\r\n and ('*' == ('{event_source}') or EventSource == ('{event_source}'))\r\n and ('*' == ('{company}') or set_has_element(todynamic(CompanyNames),'{company}'))\r\n and ('*' == ('{severity}') or AlertType == ('{severity}'))\r\n and ('*' == ('{topic}') or set_has_element(todynamic(CategoryNames), '{topic}'))\r\n and ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}'))\r\n and ('{search_keyword:label}' == '*' or (* has '{search_keyword:label}'))\r\n| mv-expand todynamic(Category)\r\n| extend Topics = Category[\"name\"]\r\n| where ('*' == ('{topic}') or Topics == '{topic}')\r\n| summarize dcount(AlertId) by tostring(Topics)\r\n| project Topics, dcount_AlertId\r\n| join kind=rightouter (DataminrPulseAlerts \r\n | where TimeGenerated >= ago(7d)\r\n | where ('*' == ('{location}') or EventLocationName == ('{location}'))\r\n and ('*' == ('{event_source}') or EventSource == ('{event_source}'))\r\n and ('*' == ('{company}') or set_has_element(todynamic(CompanyNames),'{company}'))\r\n and ('*' == ('{severity}') or AlertType == ('{severity}'))\r\n and ('*' == ('{topic}') or set_has_element(todynamic(CategoryNames), '{topic}'))\r\n and ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}'))\r\n and ('{search_keyword:label}' == '*' or (* has '{search_keyword:label}'))\r\n | mv-expand todynamic(Category)\r\n | extend Topics = Category[\"name\"]\r\n | where ('*' == ('{topic}') or Topics == '{topic}')\r\n | summarize dcount(AlertId) by tostring(Topics)\r\n | project Topics, dcount_AlertId) on Topics\r\n| extend WeekTrendvalue = dcount_AlertId1 - dcount_AlertId\r\n| extend WeekTrend = iff(WeekTrendvalue > 0,strcat(\"+\",WeekTrendvalue),tostring(WeekTrendvalue))\r\n| project Topic=Topics1, [\"Week Trend\"]=WeekTrend, Count=dcount_AlertId1\r\n| order by Count desc ", "size": 0, "showAnalytics": true, "title": "Latest Topics", "noDataMessage": "No data found in selected timerange.", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Topic", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "50%" } }, { "columnMatch": "Count", "formatter": 4, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "25%" } }, { "columnMatch": "WeekTrend", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "25%" } } ], "rowLimit": 10000, "filter": true }, "sortBy": [] }, "name": "Latest Topics", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "This panel displays data for the alerts ingested in Sentinel for the last 7 days.", "style": "info" }, "name": "text - 1" } ] }, "customWidth": "50", "name": "group - 17" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseAlerts\r\n| where ('*' == ('{location}') or EventLocationName == ('{location}'))\r\n and ('*' == ('{event_source}') or EventSource == ('{event_source}'))\r\n and ('*' == ('{company}') or set_has_element(todynamic(CompanyNames),'{company}'))\r\n and ('*' == ('{severity}') or AlertType == ('{severity}'))\r\n and ('*' == ('{topic}') or set_has_element(todynamic(CategoryNames), '{topic}'))\r\n and ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}'))\r\n and ('{search_keyword:label}' == '*' or (* has '{search_keyword:label}'))\r\n| extend dt = unixtime_milliseconds_todatetime(EventTime)\r\n| extend Time = format_datetime(dt,'MM-dd-yy HH:mm:ss')\r\n| summarize any(*) by AlertId\r\n| extend Caption = replace_string(any_Caption,\"\\n\",\" \")\r\n| project-rename [\"Alert Type\"] = any_AlertType\r\n| project Caption, [\"Alert Type\"], Time=any_Time, [\"Source Link\"] = any_PostLink\r\n| order by Time desc", "size": 0, "showAnalytics": true, "title": "Latest Alerts Details", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "exportFieldName": "Caption", "exportParameterName": "SelectedCaption", "exportDefaultValue": "none", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Caption", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "45%" } }, { "columnMatch": "Source Link", "formatter": 7, "formatOptions": { "linkTarget": "Url" } } ], "rowLimit": 10000, "filter": true } }, "name": "Latest Alerts Details", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on a row in the above 'Latest Alerts Details' grid to view more details_" }, "name": "text - 14" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let CyberAddresses = toscalar(\r\nDataminrPulseAlerts\r\n| mv-expand todynamic(EmbeddedLabels)\r\n| where ('*' == ('{location}') or EventLocationName == ('{location}'))\r\n and ('*' == ('{event_source}') or EventSource == ('{event_source}'))\r\n and ('*' == ('{company}') or set_has_element(todynamic(CompanyNames),'{company}'))\r\n and ('*' == ('{severity}') or AlertType == ('{severity}'))\r\n and ('*' == ('{topic}') or set_has_element(todynamic(CategoryNames), '{topic}'))\r\n and ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}'))\r\n and ('{search_keyword:label}' == '*' or (* has '{search_keyword:label}'))\r\n| extend Addresses = tostring(parse_json(EmbeddedLabels.data.addresses))\r\n| summarize any(*) by AlertId\r\n| extend Caption = replace_string(any_Caption,\"\\n\",\" \")\r\n| where any_Caption == ```{SelectedCaption}```\r\n| sort by AlertId\r\n| project any_Addresses\r\n);\r\nlet Vulnerabilities = toscalar(\r\nDataminrPulseAlerts\r\n| mv-expand todynamic(EmbeddedLabels)\r\n| where ('*' == ('{location}') or EventLocationName == ('{location}'))\r\n and ('*' == ('{event_source}') or EventSource == ('{event_source}'))\r\n and ('*' == ('{company}') or set_has_element(todynamic(CompanyNames),'{company}'))\r\n and ('*' == ('{severity}') or AlertType == ('{severity}'))\r\n and ('*' == ('{topic}') or set_has_element(todynamic(CategoryNames), '{topic}'))\r\n and ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}'))\r\n and ('{search_keyword:label}' == '*' or (* has '{search_keyword:label}'))\r\n| extend Vulnerabilities = parse_json(EmbeddedLabels.data.vulnerabilities)\r\n| mv-apply Vulnerabilities on (summarize VulnerabilitiesId = make_list(Vulnerabilities.id))\r\n| summarize any(*) by AlertId\r\n| extend Caption = replace_string(any_Caption,\"\\n\",\" \")\r\n| where any_Caption == ```{SelectedCaption}```\r\n| sort by AlertId\r\n| project any_VulnerabilitiesId\r\n);\r\nDataminrPulseAlerts\r\n| where ('*' == ('{location}') or EventLocationName == ('{location}'))\r\n and ('*' == ('{event_source}') or EventSource == ('{event_source}'))\r\n and ('*' == ('{company}') or set_has_element(todynamic(CompanyNames),'{company}'))\r\n and ('*' == ('{severity}') or AlertType == ('{severity}'))\r\n and ('*' == ('{topic}') or set_has_element(todynamic(CategoryNames), '{topic}'))\r\n and ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}'))\r\n and ('{search_keyword:label}' == '*' or (* has '{search_keyword:label}'))\r\n| extend Caption = replace_string(Caption,\"\\n\",\" \")\r\n| where Caption == ```{SelectedCaption}```\r\n| sort by AlertId\r\n| extend Addresses = CyberAddresses, Vulnerabilities = Vulnerabilities\r\n| project-rename [\"Alert Id\"]=AlertId, [\"Alert Post Link\"]=PostLink, [\"Alert type\"]=AlertType, [\"category Names\"]=CategoryNames, [\"Cyber Addresses\"]=Addresses, [\"Location Name\"]=EventLocationName, [\"Time Generated\"]=TimeGenerated, [\"Matched watchlist\"]=WatchlistNames, [\"Source Channels\"]=SourceChannels, [\"Vulnerability IDs\"]=Vulnerabilities\r\n| project [\"Alert Id\"], [\"Alert Post Link\"], [\"Alert type\"], Caption, [\"category Names\"], Companies=Company, [\"Cyber Addresses\"], [\"Location Name\"], [\"Time Generated\"],[\"Matched watchlist\"], Source=EventSource,[\"Source Channels\"], [\"Vulnerability IDs\"]\r\n", "size": 1, "showAnalytics": true, "title": "Selected Alert data", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Alert Id", "formatter": 7, "formatOptions": { "linkTarget": "GenericDetails", "linkIsContextBlade": true } }, { "columnMatch": "Alert Post Link", "formatter": 7, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "AlertId", "formatter": 7, "formatOptions": { "linkTarget": "GenericDetails", "linkIsContextBlade": true } } ], "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "SelectedCaption", "comparison": "isNotEqualTo", "value": "none" }, "name": "Selected Alert data", "styleSettings": { "showBorder": true } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "f139d998-2ddd-43b7-9323-c60889d9fed2", "version": "KqlParameterItem/1.0", "name": "total", "type": 1, "query": "DataminrPulseAlerts\r\n| where ('*' == ('{location}') or EventLocationName == ('{location}'))\r\n and ('*' == ('{event_source}') or EventSource == ('{event_source}'))\r\n and ('*' == ('{company}') or set_has_element(todynamic(CompanyNames),'{company}'))\r\n and ('*' == ('{severity}') or AlertType == ('{severity}'))\r\n and ('*' == ('{topic}') or set_has_element(todynamic(CategoryNames), '{topic}'))\r\n and ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}'))\r\n and ('{search_keyword:label}' == '*' or (* has '{search_keyword:label}'))\r\n| summarize dcount(AlertId) by EventSource\r\n| where isnotempty(EventSource)\r\n| summarize totalcount=sum(dcount_AlertId)\r\n| project totalcount = iff(totalcount == 0, \"0\", tostring(totalcount))", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseAlerts\r\n| where ('*' == ('{location}') or EventLocationName == ('{location}'))\r\n and ('*' == ('{event_source}') or EventSource == ('{event_source}'))\r\n and ('*' == ('{company}') or set_has_element(todynamic(CompanyNames),'{company}'))\r\n and ('*' == ('{severity}') or AlertType == ('{severity}'))\r\n and ('*' == ('{topic}') or set_has_element(todynamic(CategoryNames), '{topic}'))\r\n and ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}'))\r\n and ('{search_keyword:label}' == '*' or (* has '{search_keyword:label}'))\r\n| summarize distinct_count=dcount(AlertId) by EventSource\r\n| where isnotempty(EventSource)\r\n| order by distinct_count desc", "size": 3, "showAnalytics": true, "title": "Alerts by Source (Total {total} Alerts)", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "SelectedEventSource", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "EventSource", "createOtherGroup": 10, "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true, "maximumSignificantDigits": 15 } } } } }, "customWidth": "50", "name": "Alerts by Source", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseAlerts\r\n| where ('*' == ('{location}') or EventLocationName == ('{location}'))\r\n and ('*' == ('{event_source}') or EventSource == ('{event_source}'))\r\n and ('*' == ('{company}') or set_has_element(todynamic(CompanyNames),'{company}'))\r\n and ('*' == ('{severity}') or AlertType == ('{severity}'))\r\n and ('*' == ('{topic}') or set_has_element(todynamic(CategoryNames), '{topic}'))\r\n and ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}'))\r\n and ('{search_keyword:label}' == '*' or (* has '{search_keyword:label}'))\r\n| mv-expand todynamic(SourceChannels)\r\n| summarize distinct_count=dcount(AlertId) by tostring(SourceChannels)\r\n| where isnotempty(SourceChannels)\r\n| project tostring(SourceChannels), distinct_count\r\n| order by distinct_count desc", "size": 3, "showAnalytics": true, "title": "Alerts by Channel", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "SelectedChannels", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "SourceChannels", "createOtherGroup": 10, "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true, "maximumSignificantDigits": 15 } } } } }, "customWidth": "50", "name": "query - 6", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on the above 'Alerts by Source' pie chart to view more details_" }, "customWidth": "50", "name": "text - 15" }, { "type": 1, "content": { "json": "_💡 Click on the above 'Alerts by Channel' pie chart to view more details_\r\n\r\n" }, "customWidth": "50", "name": "text - 16" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseAlerts\r\n| mv-expand todynamic(Company), todynamic(WatchlistsMatchedByType), todynamic(Category), todynamic(EmbeddedLabels)\r\n| extend Vulnerabilities = parse_json(EmbeddedLabels.data.vulnerabilities), Addresses = parse_json(EmbeddedLabels.data.addresses)\r\n| where ('*' == ('{location}') or EventLocationName == ('{location}'))\r\n and ('*' == ('{event_source}') or EventSource == ('{event_source}'))\r\n and ('*' == ('{company}') or set_has_element(todynamic(CompanyNames),'{company}'))\r\n and ('*' == ('{severity}') or AlertType == ('{severity}'))\r\n and ('*' == ('{topic}') or set_has_element(todynamic(CategoryNames), '{topic}'))\r\n and ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}'))\r\n and ('{search_keyword:label}' == '*' or (* has '{search_keyword:label}'))\r\n| mv-expand Vulnerabilities\r\n| mv-apply Vulnerabilities on (summarize VulnerabilitiesId = make_list(Vulnerabilities.id))\r\n| summarize any(*) by AlertId\r\n| where any_EventSource=='{SelectedEventSource}'\r\n| project-rename [\"Alert Id\"]=AlertId, [\"Alert Post Link\"]=any_PostLink, [\"Alert type\"]=any_AlertType, [\"category Names\"]=any_CategoryNames, [\"Cyber Addresses\"]=any_Addresses, [\"Location Name\"]=any_EventLocationName, [\"Time Generated\"]=any_TimeGenerated, [\"Matched watchlist\"]=any_WatchlistNames, [\"Source Channels\"]=any_SourceChannels, [\"Vulnerability IDs\"]=any_VulnerabilitiesId\r\n| project [\"Alert Id\"], [\"Alert Post Link\"], [\"Alert type\"], Caption=any_Caption, [\"category Names\"], Companies=any_Company, [\"Cyber Addresses\"], [\"Location Name\"], [\"Time Generated\"],[\"Matched watchlist\"], Source=any_EventSource,[\"Source Channels\"], [\"Vulnerability IDs\"]\r\n", "size": 0, "showAnalytics": true, "title": "Selected Alerts by Source Data", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Alert Id", "formatter": 7, "formatOptions": { "linkTarget": "GenericDetails", "linkIsContextBlade": true } }, { "columnMatch": "Alert Post Link", "formatter": 7, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "Companies", "formatter": 1 }, { "columnMatch": "Cyber Addresses", "formatter": 1 }, { "columnMatch": "Time Generated", "formatter": 6 } ], "rowLimit": 10000, "filter": true }, "sortBy": [] }, "conditionalVisibilities": [ { "parameterName": "SelectedEventSource", "comparison": "isNotEqualTo", "value": "none" }, { "parameterName": "SelectedEventSource", "comparison": "isNotEqualTo", "value": "Other" } ], "name": "Selected Alerts by Source Data", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DataminrPulseAlerts\r\n| mv-expand todynamic(Company), todynamic(WatchlistsMatchedByType), todynamic(Category), todynamic(EmbeddedLabels)\r\n| extend Vulnerabilities = parse_json(EmbeddedLabels.data.vulnerabilities), Addresses = parse_json(EmbeddedLabels.data.addresses)\r\n| where ('*' == ('{location}') or EventLocationName == ('{location}'))\r\n and ('*' == ('{event_source}') or EventSource == ('{event_source}'))\r\n and ('*' == ('{company}') or set_has_element(todynamic(CompanyNames),'{company}'))\r\n and ('*' == ('{severity}') or AlertType == ('{severity}'))\r\n and ('*' == ('{topic}') or set_has_element(todynamic(CategoryNames), '{topic}'))\r\n and ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}'))\r\n and ('{search_keyword:label}' == '*' or (* has '{search_keyword:label}'))\r\n| mv-expand Vulnerabilities\r\n| mv-apply Vulnerabilities on (summarize VulnerabilitiesId = make_list(Vulnerabilities.id))\r\n| summarize any(*) by AlertId\r\n| mv-expand todynamic(any_SourceChannels)\r\n| where tostring(any_SourceChannels)=='{SelectedChannels}'\r\n| project-rename [\"Alert Id\"]=AlertId, [\"Alert Post Link\"]=any_PostLink, [\"Alert type\"]=any_AlertType, [\"category Names\"]=any_CategoryNames, [\"Cyber Addresses\"]=any_Addresses, [\"Location Name\"]=any_EventLocationName, [\"Time Generated\"]=any_TimeGenerated, [\"Matched watchlist\"]=any_WatchlistNames, [\"Source Channels\"]=any_SourceChannels, [\"Vulnerability IDs\"]=any_VulnerabilitiesId\r\n| project [\"Alert Id\"], [\"Alert Post Link\"], [\"Alert type\"], Caption=any_Caption, [\"category Names\"], Companies=any_Company, [\"Cyber Addresses\"], [\"Location Name\"], [\"Time Generated\"],[\"Matched watchlist\"], Source=any_EventSource,[\"Source Channels\"], [\"Vulnerability IDs\"]\r\n", "size": 0, "showAnalytics": true, "title": "Selected Alerts by Channel Data", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Alert Id", "formatter": 7, "formatOptions": { "linkTarget": "GenericDetails", "linkIsContextBlade": true } }, { "columnMatch": "Alert Post Link", "formatter": 7, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "Companies", "formatter": 1 }, { "columnMatch": "Cyber Addresses", "formatter": 1 } ], "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "Cyber Addresses", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "Cyber Addresses", "sortOrder": 2 } ] }, "conditionalVisibilities": [ { "parameterName": "SelectedChannels", "comparison": "isNotEqualTo", "value": "none" }, { "parameterName": "SelectedChannels", "comparison": "isNotEqualTo", "value": "Other" } ], "name": "Selected Alerts by Channel Data", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let total = toscalar(DataminrPulseAlerts\r\n| mv-expand todynamic(EmbeddedLabels)\r\n| where ('*' == ('{location}') or EventLocationName == ('{location}'))\r\n and ('*' == ('{event_source}') or EventSource == ('{event_source}'))\r\n and ('*' == ('{company}') or set_has_element(todynamic(CompanyNames),'{company}'))\r\n and ('*' == ('{severity}') or AlertType == ('{severity}'))\r\n and ('*' == ('{topic}') or set_has_element(todynamic(CategoryNames), '{topic}'))\r\n and ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}'))\r\n and ('{search_keyword:label}' == '*' or (* has '{search_keyword:label}'))\r\n| extend addresses = parse_json(EmbeddedLabels.data.addresses)\r\n| mv-apply addresses on (summarize ip=make_list(addresses.ip))\r\n| mv-expand ip\r\n| summarize dcount(AlertId) by tostring(ip)\r\n| summarize total=sum(dcount_AlertId)\r\n| project total);\r\nDataminrPulseAlerts\r\n| mv-expand todynamic(EmbeddedLabels)\r\n| where ('*' == ('{location}') or EventLocationName == ('{location}'))\r\n and ('*' == ('{event_source}') or EventSource == ('{event_source}'))\r\n and ('*' == ('{company}') or set_has_element(todynamic(CompanyNames),'{company}'))\r\n and ('*' == ('{severity}') or AlertType == ('{severity}'))\r\n and ('*' == ('{topic}') or set_has_element(todynamic(CategoryNames), '{topic}'))\r\n and ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}'))\r\n and ('{search_keyword:label}' == '*' or (* has '{search_keyword:label}'))\r\n| extend addresses = parse_json(EmbeddedLabels.data.addresses)\r\n| mv-apply addresses on (summarize ip=make_list(addresses.ip))\r\n| mv-expand ip\r\n| where isnotempty(ip)\r\n| summarize dcount(AlertId) by tostring(ip)\r\n| extend Percent = 100*todouble(dcount_AlertId)/total\r\n| project-rename Count = dcount_AlertId\r\n| project [\"IP Address\"]=ip, Count, Percent\r\n| order by Percent desc\r\n| limit 10", "size": 0, "showAnalytics": true, "title": "Top 10 Exploiting IP Addresses", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 4, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "Percent", "formatter": 4, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 1, "options": { "style": "decimal", "maximumFractionDigits": 2 } } } ], "rowLimit": 10000, "filter": true }, "sortBy": [] }, "customWidth": "33.33", "name": "Top 10 Exploiting IP Addresses", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let total = toscalar(DataminrPulseAlerts\r\n| mv-expand todynamic(EmbeddedLabels)\r\n| where ('*' == ('{location}') or EventLocationName == ('{location}'))\r\n and ('*' == ('{event_source}') or EventSource == ('{event_source}'))\r\n and ('*' == ('{company}') or set_has_element(todynamic(CompanyNames),'{company}'))\r\n and ('*' == ('{severity}') or AlertType == ('{severity}'))\r\n and ('*' == ('{topic}') or set_has_element(todynamic(CategoryNames), '{topic}'))\r\n and ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}'))\r\n and ('{search_keyword:label}' == '*' or (* has '{search_keyword:label}'))\r\n| extend vulnerabilities = parse_json(EmbeddedLabels.data.vulnerabilities)\r\n| mv-apply vulnerabilities on (summarize vulnids=make_list(vulnerabilities.id))\r\n| mv-expand vulnids\r\n| where isnotempty(vulnids)\r\n| summarize dcount(AlertId) by tostring(vulnids)\r\n| summarize total=sum(dcount_AlertId)\r\n| project total);\r\nDataminrPulseAlerts\r\n| mv-expand todynamic(EmbeddedLabels)\r\n| where ('*' == ('{location}') or EventLocationName == ('{location}'))\r\n and ('*' == ('{event_source}') or EventSource == ('{event_source}'))\r\n and ('*' == ('{company}') or set_has_element(todynamic(CompanyNames),'{company}'))\r\n and ('*' == ('{severity}') or AlertType == ('{severity}'))\r\n and ('*' == ('{topic}') or set_has_element(todynamic(CategoryNames), '{topic}'))\r\n and ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}'))\r\n and ('{search_keyword:label}' == '*' or (* has '{search_keyword:label}'))\r\n| extend vulnerabilities = parse_json(EmbeddedLabels.data.vulnerabilities)\r\n| mv-apply vulnerabilities on (summarize vulnids=make_list(vulnerabilities.id))\r\n| mv-expand vulnids\r\n| where isnotempty(vulnids)\r\n| summarize dcount(AlertId) by tostring(vulnids)\r\n| extend Percent = 100*todouble(dcount_AlertId)/total\r\n| project-rename Count = dcount_AlertId\r\n| project [\"Vulnerability ID\"]=vulnids, Count, Percent\r\n| order by Percent desc\r\n| limit 10", "size": 0, "showAnalytics": true, "title": "Top 10 Trending CVEs", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 4, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "Percent", "formatter": 4, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 1, "options": { "style": "decimal", "maximumFractionDigits": 2 } } } ], "rowLimit": 10000, "filter": true }, "sortBy": [] }, "customWidth": "33.33", "name": "Top 10 Trending CVEs", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let total = toscalar(DataminrPulseAlerts\r\n| mv-expand todynamic(EmbeddedLabels)\r\n| where ('*' == ('{location}') or EventLocationName == ('{location}'))\r\n and ('*' == ('{event_source}') or EventSource == ('{event_source}'))\r\n and ('*' == ('{company}') or set_has_element(todynamic(CompanyNames),'{company}'))\r\n and ('*' == ('{severity}') or AlertType == ('{severity}'))\r\n and ('*' == ('{topic}') or set_has_element(todynamic(CategoryNames), '{topic}'))\r\n and ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}'))\r\n and ('{search_keyword:label}' == '*' or (* has '{search_keyword:label}'))\r\n| extend addresses = parse_json(EmbeddedLabels.data.addresses)\r\n| mv-apply addresses on (summarize port=make_list(addresses.port))\r\n| mv-expand port\r\n| summarize dcount(AlertId) by tostring(port)\r\n| summarize total=sum(dcount_AlertId)\r\n| project total);\r\nDataminrPulseAlerts\r\n| mv-expand todynamic(EmbeddedLabels)\r\n| where ('*' == ('{location}') or EventLocationName == ('{location}'))\r\n and ('*' == ('{event_source}') or EventSource == ('{event_source}'))\r\n and ('*' == ('{company}') or set_has_element(todynamic(CompanyNames),'{company}'))\r\n and ('*' == ('{severity}') or AlertType == ('{severity}'))\r\n and ('*' == ('{topic}') or set_has_element(todynamic(CategoryNames), '{topic}'))\r\n and ('*' == ('{watchlist}') or set_has_element(todynamic(WatchlistNames),'{watchlist}'))\r\n and ('{search_keyword:label}' == '*' or (* has '{search_keyword:label}'))\r\n| extend addresses = parse_json(EmbeddedLabels.data.addresses)\r\n| mv-apply addresses on (summarize port=make_list(addresses.port))\r\n| mv-expand port\r\n| where isnotempty(port)\r\n| summarize dcount(AlertId) by tostring(port)\r\n| extend Percent = 100*todouble(dcount_AlertId)/total\r\n| project-rename Count = dcount_AlertId\r\n| project [\"Port\"]=port, Count, Percent\r\n| sort by Percent desc\r\n| limit 10", "size": 0, "showAnalytics": true, "title": "Top 10 Open Ports", "noDataMessage": "No data found in selected timerange.", "timeContextFromParameter": "time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 4, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "Percent", "formatter": 4, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 1, "options": { "style": "decimal", "maximumFractionDigits": 2 } } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "33.33", "name": "Top 10 Open Ports", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "📝 ***Refresh the web page to fetch details of recently collected events***" }, "name": "text - 9" } ] }, "conditionalVisibility": { "parameterName": "setTab", "comparison": "isEqualTo", "value": "Alerts Drilldown" }, "name": "Alerts Drilldown" } ], "fromTemplateId": "sentinel-DataminrPulseAlerts", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }