{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "version": "KqlParameterItem/1.0", "name": "DefaultSubscription_Internal", "type": 1, "isRequired": true, "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| take 1\r\n| project subscriptionId", "crossComponentResources": [ "value::selected" ], "isHiddenWhenLocked": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "id": "314d02bf-4691-43fa-af59-d67073c8b8fa" }, { "id": "e6ded9a1-a83c-4762-938d-5bf8ff3d3d38", "version": "KqlParameterItem/1.0", "name": "Subscription", "type": 6, "isRequired": true, "query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)", "value": "/subscriptions/d1d8779d-38d7-4f06-91db-9cbc8de0176f", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "e3225ed0-6210-40a1-b2d0-66e42ffa71d6", "version": "KqlParameterItem/1.0", "name": "Workspace", "type": 5, "isRequired": true, "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| order by name asc\r\n| summarize Selected = makelist(id, 10), All = makelist(id, 1000)\r\n| mvexpand All limit 100\r\n| project value = tostring(All), label = tostring(All), selected = iff(Selected contains All, true, false)", "crossComponentResources": [ "{Subscription}" ], "value": [], "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "15b2c181-7397-43c1-900a-28e175ae8a6f", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2592000000 } ], "allowCustom": true }, "value": { "durationMs": 604800000 } } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "Parameter Selectors" }, { "type": 1, "content": { "json": "  Please take time to answer a quick survey,\r\n[ click here. ](https://forms.office.com/r/NXQxaCxzFi)" }, "name": "Survey" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Microsoft Purview Insider Risk Management Solution](https://docs.microsoft.com/microsoft-365/compliance/insider-risk-management-solution-overview)\n---\n\nInsider risk management helps minimize internal risks by enabling you to detect, investigate, and act on malicious and inadvertent activities in your organization. Insider risk policies allow you to define the types of risks to identify and detect in your organization, including acting on cases and escalating cases to Microsoft Purview eDiscovery. Risk analysts in your organization can quickly take appropriate actions to make sure users are compliant with your organization's compliance standards. Insider risks come in various forms including both witting (intentional) and unwitting (unintentional). This workbook provides an automated visualization of Insider risk behavior cross walked to respective capabilities in 1st/3rd Party, Cloud, and Multi-Cloud workloads.\n" }, "name": "text - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "1bad541e-219a-4277-9510-876b0e8cad51", "cellValue": "https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/announcing-the-microsoft-sentinel-microsoft-insider-risk/ba-p/2955786", "linkTarget": "Url", "linkLabel": "Solution Blog", "style": "link" }, { "id": "7e8ff8aa-f632-4a4d-90cf-a71da0dc6b31", "cellValue": "https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/MicrosoftPurviewInsiderRiskManagement", "linkTarget": "Url", "linkLabel": "GitHub Repo", "style": "link" } ] }, "name": "links - 29" } ] }, "customWidth": "78", "name": "group - 5" }, { "type": 1, "content": { "json": "![Image Name](https://azure.microsoft.com/svghandler/azure-sentinel?width=600&height=315) " }, "customWidth": "21", "name": "Microsoft Sentinel Logo" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "ac6f7462-59ff-4d82-86b0-0a6eccc35a51", "version": "KqlParameterItem/1.0", "name": "UserPrincipalName", "label": "🔀 User Selector", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SigninLogs\r\n| summarize by UserPrincipalName ", "value": [ "value::all" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "User Selector Parameter - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t{ \\\"Capabilities\\\": \\\"Getting Started\\\", \\\"tab\\\": \\\"Help\\\" },\\r\\n\\t{ \\\"Capabilities\\\": \\\"Insider Risk Management Alerts\\\", \\\"tab\\\": \\\"InsiderRisks\\\" },\\r\\n\\t{ \\\"Capabilities\\\": \\\"User & Entity Behavior Analytics\\\", \\\"tab\\\": \\\"UEBA\\\" },\\r\\n\\t{ \\\"Capabilities\\\": \\\"Watchlists\\\", \\\"tab\\\": \\\"Watchlists\\\" },\\r\\n\\t{ \\\"Capabilities\\\": \\\"Open Insider Risk Management Case\\\", \\\"tab\\\": \\\"IRM\\\" },\\r\\n\\t{ \\\"Capabilities\\\": \\\"Entity Search\\\", \\\"tab\\\": \\\"EntitySearch\\\" },\\r\\n\\t{ \\\"Capabilities\\\": \\\"Security Alerts\\\", \\\"tab\\\": \\\"SecurityAlerts\\\" },\\r\\n { \\\"Capabilities\\\": \\\"Security Incidents\\\", \\\"tab\\\": \\\"SecurityIncidents\\\" },\\r\\n\\t{ \\\"Capabilities\\\": \\\"Behavior Logs\\\", \\\"tab\\\": \\\"BehaviorLogs\\\" }\\r\\n]\",\"transformers\":null}", "size": 3, "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "tab", "parameterName": "tab2" } ], "queryType": 8, "gridSettings": { "formatters": [ { "columnMatch": "tab", "formatter": 5 } ] } }, "customWidth": "40", "name": "Control Family ", "styleSettings": { "showBorder": true } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "cbb7a53e-ea3b-44e3-804e-734662e21144", "version": "KqlParameterItem/1.0", "name": "isHelpVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "tab2", "operator": "contains", "rightValType": "static", "rightVal": "Help", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "id": "7b682fc9-cb6b-4475-a24c-41dcb43d0cef", "version": "KqlParameterItem/1.0", "name": "isInsiderRisksVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "tab2", "operator": "contains", "rightValType": "static", "rightVal": "InsiderRisks", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "isUEBAVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "tab2", "operator": "contains", "rightValType": "static", "rightVal": "UEBA", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "70014e2e-d25a-4cca-b78d-b6063795d138" }, { "id": "b2d05502-68c5-4d0c-8caa-d5e439a2b9ac", "version": "KqlParameterItem/1.0", "name": "isWatchlistsVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "tab2", "operator": "contains", "rightValType": "static", "rightVal": "Watchlists", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "id": "086e8f81-2a72-4e52-acab-40631bb21ed5", "version": "KqlParameterItem/1.0", "name": "isIRMVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "tab2", "operator": "contains", "rightValType": "static", "rightVal": "IRM", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "id": "c01e6494-1f74-4194-88b3-c98bbabdf84f", "version": "KqlParameterItem/1.0", "name": "isEntitySearchVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "tab2", "operator": "contains", "rightValType": "static", "rightVal": "EntitySearch", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "isSecurityAlertsVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "tab2", "operator": "contains", "rightValType": "static", "rightVal": "SecurityAlerts", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "9ade41e9-0382-49a7-847a-472bfb7e284b" }, { "version": "KqlParameterItem/1.0", "name": "isSecurityIncidentsVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "tab2", "operator": "contains", "rightValType": "static", "rightVal": "SecurityIncidents", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "10763d51-939b-4c9e-a335-fbdb310bef3d" }, { "version": "KqlParameterItem/1.0", "name": "isBehaviorLogsVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "tab2", "operator": "contains", "rightValType": "static", "rightVal": "BehaviorLogs", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "fe9411bf-bea5-476d-9e3c-d04a15e69a41" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "10", "name": "Hidden Parameters Selectors" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t{ \\\"Capabilities\\\": \\\"Sign-Ins\\\", \\\"tab\\\": \\\"SignIns\\\" },\\r\\n\\t{ \\\"Capabilities\\\": \\\"Azure Activity\\\", \\\"tab\\\": \\\"AzureActivity\\\" },\\r\\n\\t{ \\\"Capabilities\\\": \\\"Microsoft 365 Activity\\\", \\\"tab\\\": \\\"M365Activity\\\" },\\r\\n\\t{ \\\"Capabilities\\\": \\\"Audit Logs\\\", \\\"tab\\\": \\\"AuditLogs\\\" },\\r\\n { \\\"Capabilities\\\": \\\"Log Queries\\\", \\\"tab\\\": \\\"LogQueries\\\" },\\r\\n { \\\"Capabilities\\\": \\\"Data Loss Prevention\\\", \\\"tab\\\": \\\"DLP\\\" },\\r\\n { \\\"Capabilities\\\": \\\"Microsoft Sentinel: Deception Solution\\\", \\\"tab\\\": \\\"Deception\\\" },\\r\\n { \\\"Capabilities\\\": \\\"Artificial Intelligence & Machine Learning\\\", \\\"tab\\\": \\\"AIML\\\" },\\r\\n\\t{ \\\"Capabilities\\\": \\\"Recommended Content\\\", \\\"tab\\\": \\\"GC\\\" }\\r\\n\\r\\n]\",\"transformers\":null}", "size": 3, "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "tab", "parameterName": "tab2" } ], "queryType": 8, "gridSettings": { "formatters": [ { "columnMatch": "tab", "formatter": 5 } ] } }, "customWidth": "40", "name": "Control Family - Copy", "styleSettings": { "showBorder": true } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "be8a3fb4-0a78-4c85-bf8b-a68df5fe224f", "version": "KqlParameterItem/1.0", "name": "isSignInsVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "tab2", "operator": "contains", "rightValType": "static", "rightVal": "SignIns", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "id": "d6bf3cbe-bbd6-49aa-afb7-07d875e86ecd", "version": "KqlParameterItem/1.0", "name": "isAzureActivityVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "tab2", "operator": "contains", "rightValType": "static", "rightVal": "AzureActivity", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "id": "15502fa8-917a-4573-9fcd-863c64950838", "version": "KqlParameterItem/1.0", "name": "isM365ActivityVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "tab2", "operator": "contains", "rightValType": "static", "rightVal": "M365Activity", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "id": "ea558e57-ae94-43cf-9e03-93a3354dcc27", "version": "KqlParameterItem/1.0", "name": "isAuditLogsVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "tab2", "operator": "contains", "rightValType": "static", "rightVal": "AuditLogs", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "id": "5077187c-538d-43d7-998b-ea2ec4fb9e1f", "version": "KqlParameterItem/1.0", "name": "isLogQueriesVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "tab2", "operator": "contains", "rightValType": "static", "rightVal": "LogQueries", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "id": "33254920-6763-4f4b-acdb-057c82b0d745", "version": "KqlParameterItem/1.0", "name": "isDLPVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "tab2", "operator": "contains", "rightValType": "static", "rightVal": "DLP", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "isDeceptionVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "tab2", "operator": "contains", "rightValType": "static", "rightVal": "Deception", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "0fd602af-6702-4c3e-abed-31dee8e80bfd" }, { "version": "KqlParameterItem/1.0", "name": "isAIMLVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "tab2", "operator": "contains", "rightValType": "static", "rightVal": "AIML", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 }, "id": "2b246f5b-0836-4695-aa9d-34dee822646d" }, { "id": "65a7fc30-b663-4a70-9fe0-891ed1375710", "version": "KqlParameterItem/1.0", "name": "isGCVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "tab2", "operator": "contains", "rightValType": "static", "rightVal": "GC", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "10", "name": "Hidden Parameters Selectors - Copy" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Getting Started](https://docs.microsoft.com/azure/sentinel/prerequisites)\n---\n\nThis workbook enables Insider Risk Teams, SecOps Analysts, and MSSPs to gain situational awareness for cloud workload security posture. This workbook is designed to augment staffing through automation, artificial intelligence, machine learning, query+alerting generation and visualizations. All panels use dynamic display, meaning they only display if data/results are available. Recommended onboarding steps are included below, note user experience will vary by workload.
\n
\n1️⃣ [Onboard Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/quickstart-onboard)
\n2️⃣ [Onboard Microsoft Purview Insider Risk Management](https://docs.microsoft.com/microsoft-365/compliance/insider-risk-management-configure)
\n3️⃣ [Enable the Microsoft Purview Insider Risk Management Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#microsoft-365-insider-risk-management-irm-preview)
\n4️⃣ [Enable User Entity Behavior Analytics](https://docs.microsoft.com/azure/sentinel/enable-entity-behavior-analytics)
\n5️⃣ [Configure Watchlist via SearchKey Columns](https://docs.microsoft.com/azure/sentinel/watchlists)
\n\n\n\n" }, "customWidth": "45", "name": "text - 2", "styleSettings": { "maxWidth": "45" } }, { "type": 1, "content": { "json": "" }, "customWidth": "5", "name": "text - 11" }, { "type": 1, "content": { "json": "# [Recommended Enrichments](https://docs.microsoft.com/azure/sentinel/connect-data-sources)\n---\nThis workbook leverages 25+ Microsoft Security products. While only Microsoft Sentinel is mandatory for this solution, the following offerings provide enrichments:
\n\n✳️ [Microsoft Purview Insider Risk Management](https://docs.microsoft.com/microsoft-365/compliance/insider-risk-management-solution-overview)
\n✳️ [Microsoft Purview Communications Compliance](https://docs.microsoft.com/microsoft-365/compliance/communication-compliance-solution-overview)
\n✳️ [Microsoft Purview Information Protection](https://docs.microsoft.com/microsoft-365/compliance/information-protection)
\n✳️ [Microsoft Purview eDiscovery](https://docs.microsoft.com/microsoft-365/compliance/ediscovery)
\n✳️ [Microsoft Sentinel Notebooks](https://docs.microsoft.com/azure/sentinel/notebooks)
\n✳️ [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender)
\n✳️ [Microsoft Defender for Identity](https://www.microsoft.com/microsoft-365/security/identity-defender)
\n✳️ [Microsoft Cloud App Security](https://www.microsoft.com/microsoft-365/enterprise-mobility-security/cloud-app-security)
\n✳️ [Microsoft Defender XDR](https://www.microsoft.com/microsoft-365/security/microsoft-365-defender)
\n✳️ [Microsoft Defender for Office 365](https://www.microsoft.com/microsoft-365/security/office-365-defender)
\n✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\n\n\n" }, "customWidth": "45", "name": "text - 11", "styleSettings": { "maxWidth": "45" } }, { "type": 1, "content": { "json": "## [Common Insider Risks](https://docs.microsoft.com/microsoft-365/compliance/insider-risk-solution-overview)\r\n![Image Name](https://docs.microsoft.com/microsoft-365/media/ir-solution-threats.png)\r\n\r\n\r\n" }, "customWidth": "40", "name": "text - 179" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 7" }, { "type": 1, "content": { "json": "## [Insider Risk Management Workflows](https://docs.microsoft.com/microsoft-365/compliance/insider-risk-management#workflow)\r\n![Image Name](https://docs.microsoft.com/microsoft-365/media/insider-risk-workflow.png) \r\n\r\n\r\n\r\n" }, "customWidth": "40", "name": "text - 179" }, { "type": 1, "content": { "json": "## [Deploy Microsoft Purview Insider Risk Solutions](https://docs.microsoft.com/microsoft-365/compliance/insider-risk-solution-overview?#deploy-microsoft-365-insider-risk-solutions)\r\n![Image Name](https://docs.microsoft.com/microsoft-365/media/ir-solution-defense-in-depth.png)\r\n\r\n\r\n" }, "customWidth": "40", "name": "text - 179" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 8" }, { "type": 1, "content": { "json": "## [Implement Microsoft Purview Communications Compliance to Detect and Act on Inappropriate Messages](https://docs.microsoft.com//microsoft-365/compliance/communication-compliance-solution-overview)\r\n![Image Name](https://docs.microsoft.com/microsoft-365/media/ir-solution-cc-steps.png) \r\n\r\n\r\n\r\n" }, "customWidth": "40", "name": "text - 179" }, { "type": 1, "content": { "json": "## [Implement Microsoft Purview Information Protection for Data Loss Prevention (DLP)](https://docs.microsoft.com/microsoft-365/compliance/information-protection)\r\n![Image Name](https://docs.microsoft.com/microsoft-365/media/powered-by-intelligent-platform.png) \r\n\r\n\r\n\r\n" }, "customWidth": "40", "name": "text - 179", "styleSettings": { "maxWidth": "40" } }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 9" }, { "type": 1, "content": { "json": "## [Implement Microsoft Purview eDiscovery to Support Investigations](https://docs.microsoft.com/microsoft-365/compliance/create-and-manage-advanced-ediscoveryv2-case)\r\n![Image Name](https://docs.microsoft.com/microsoft-365/media/aedworkflow.png) \r\n\r\n\r\n\r\n" }, "customWidth": "40", "name": "text - 179", "styleSettings": { "maxWidth": "40" } } ] }, "conditionalVisibility": { "parameterName": "isHelpVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Overview Group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Microsoft Purview Insider Risk Management](https://docs.microsoft.com/microsoft-365/compliance/insider-risk-management-solution-overview)\n---\n\nIncreasingly, employees have more access to create, manage, and share data across a broad spectrum of platforms and services. In most cases, organizations have limited resources and tools to identify and mitigate organization-wide risks while also meeting compliance requirements and employee privacy standards. These risks may include data theft by departing employees and data leaks of information outside your organization by accidental oversharing or malicious intent.\n\nInsider risk management in Microsoft 365 uses the full breadth of service and 3rd-party indicators to help you quickly identify, triage, and act on risky user activity. By using logs from Microsoft 365 and Microsoft Graph, insider risk management allows you to define specific policies to identify risk indicators and to take action to mitigate these risks.
\n\n\n\n" }, "customWidth": "40", "name": "text - 2" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 6" }, { "type": 1, "content": { "json": "#### [Microsoft Purview Insider Risk Management >>](https://compliance.microsoft.com/insiderriskmgmt?viewid=overview)
\r\n#### [Microsoft Purview Communications Compliance >>](https://compliance.microsoft.com/supervisoryreview?viewid=Policies)
\r\n#### [Microsoft Purview eDiscovery >>](https://compliance.microsoft.com/advancedediscovery?viewid=Overview)
\r\n" }, "customWidth": "33", "name": "text - 5", "styleSettings": { "maxWidth": "33" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityAlert\r\n| where ProductName == \"Microsoft 365 Insider Risk Management\"\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n| extend Href_ = tostring(parse_json(ExtendedLinks)[0].Href)\r\n| extend UserPrincipalName = UPN\r\n| summarize count() by UserPrincipalName\r\n| render piechart\r\n", "size": 0, "showAnalytics": true, "title": "Microsoft Purview: Insider Risk Management Alerts by User", "noDataMessage": "No results, Confirm Microsoft Purview Insider Risk Management is Onboarded and Microsoft Insider Risk Management Connector is Enabled. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "3", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ProductName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Alert >" } }, { "columnMatch": "UPN", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "2", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Incident >" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "Results300" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityAlert\r\n| where ProductName == \"Microsoft 365 Insider Risk Management\"\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n| extend Href_ = tostring(parse_json(ExtendedLinks)[0].Href)\r\n| extend UserPrincipalName = UPN\r\n| where ProductName == \"Microsoft 365 Insider Risk Management\"\r\n| distinct AlertName, ProductName, Status, AlertLink, UserPrincipalName, Tactics, TimeGenerated\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by AlertName\r\n| render timechart", "size": 0, "showAnalytics": true, "title": "Microsoft Purview: Insider Risk Management Alerts over Time", "noDataMessage": "No results, Confirm Microsoft Purview Insider Risk Management is Onboarded and Microsoft Insider Risk Management Connector is Enabled. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "3", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ProductName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Alert >" } }, { "columnMatch": "UPN", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "2", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Incident >" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "Yes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityAlert\r\n| where ProductName == \"Microsoft 365 Insider Risk Management\"\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n| extend Href_ = tostring(parse_json(ExtendedLinks)[0].Href)\r\n| extend UserPrincipalName = UPN\r\n| distinct AlertName, ProductName, Status, AlertLink, UserPrincipalName, Tactics, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Microsoft Purview: Insider Risk Management Alert Details", "noDataMessage": "No results, Confirm Microsoft Purview Insider Risk Management is Onboarded and Microsoft Insider Risk Management Connector is Enabled. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "3", "text": "{0}{1}" } ] } }, { "columnMatch": "ProductName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Alert >" } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "UPN", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "2", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Incident >" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "name": "Microsoft 365: Insider Risk Management Alerts" } ] }, "conditionalVisibility": { "parameterName": "isInsiderRisksVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Insider Risk Management Alerts" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [User & Entity Behavior Analytics](https://docs.microsoft.com/azure/sentinel/identify-threats-with-entity-behavior-analytics)\n---\n\nIdentifying threats inside your organization and their potential impact - whether a compromised entity or a malicious insider - has always been a time-consuming and labor-intensive process. Sifting through alerts, connecting the dots, and active hunting all add up to massive amounts of time and effort expended with minimal returns, and the possibility of sophisticated threats simply evading discovery. Particularly elusive threats like zero-day, targeted, and advanced persistent threats can be the most dangerous to your organization, making their detection all the more critical.
\n\n\n\n" }, "customWidth": "40", "name": "text - 2" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 14" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "60106e49-64fe-43dc-9f83-a20b316e43c2", "linkTarget": "OpenBlade", "linkLabel": "Entity Behavior", "style": "secondary", "bladeOpenContext": { "bladeName": "EntitySearchBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [] } } ] }, "customWidth": "15", "name": "EL0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let AnomalousSigninActivity = BehaviorAnalytics\r\n | where ActionType == \"Sign-in\"\r\n | where (UsersInsights.NewAccount == True or UsersInsights.DormantAccount == True) and (\r\n ActivityInsights.FirstTimeUserAccessedResource == True and ActivityInsights.ResourceUncommonlyAccessedAmongPeers == True\r\n or ActivityInsights.FirstTimeUserUsedApp == True and ActivityInsights.AppUncommonlyUsedAmongPeers == False)\r\n | join (\r\n SigninLogs | where Status.errorCode == 0 or Status.errorCode == 0 and RiskDetail != \"none\"\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Successful Logon\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Valid Accounts\",\r\n SubTechnique = \"\",\r\n Description = \"Successful Sign-in with one or more of the following indications: sign by new or recently dormant accounts and sign in with resource for the first time (while none of their peers did) or to an app for the first time (while none of their peers did) or performed by a user with Risk indication from AAD\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet critical = dynamic(['9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3', 'c4e39bd9-1100-46d3-8c65-fb160da0071f', '158c047a-c907-4556-b7ef-446551a6b5f7', '62e90394-69f5-4237-9190-012177145e10', 'd29b2b05-8046-44ba-8758-1e26182fcf32', '729827e3-9c14-49f7-bb1b-9608f156bbb8', '966707d0-3269-4727-9be2-8c3a10f19b9d', '194ae4cb-b126-40b2-bd5b-6091b380977d', 'fe930be7-5e62-47db-91af-98c3a49a38b1']);\r\nlet high = dynamic(['cf1c38e5-3621-4004-a7cb-879624dced7c', '7495fdc4-34c4-4d15-a289-98788ce399fd', 'aaf43236-0c0d-4d5f-883a-6955382ac081', '3edaf663-341e-4475-9f94-5c398ef6c070', '7698a772-787b-4ac8-901f-60d6b08affd2', 'b1be1c3e-b65d-4f19-8427-f6fa0d97feb9', '9f06204d-73c1-4d4c-880a-6edb90606fd8', '29232cdf-9323-42fd-ade2-1d097af3e4de', 'be2f45a1-457d-42af-a067-6ec1fa63bc45', '7be44c8a-adaf-4e2a-84d6-ab2649e08a13', 'e8611ab8-c189-46e8-94e1-60213ab1f814']);//insider\r\nlet AnomalousRoleAssignment = AuditLogs\r\n | where TimeGenerated > ago(28d)\r\n | where OperationName == \"Add member to role\"\r\n | mv-expand TargetResources\r\n | extend RoleId = tostring(TargetResources.modifiedProperties[0].newValue)\r\n | where isnotempty(RoleId) and RoleId in (critical, high)\r\n | extend RoleName = tostring(TargetResources.modifiedProperties[1].newValue)\r\n | where isnotempty(RoleName)\r\n | extend TargetId = tostring(TargetResources.id)\r\n | extend Target = tostring(TargetResources.userPrincipalName)\r\n | join kind=inner (\r\n BehaviorAnalytics\r\n | where ActionType == \"Add member to role\"\r\n | where UsersInsights.BlasrRadius == \"High\" or ActivityInsights.FirstTimeUserPerformedAction == true\r\n )\r\n on $left._ItemId == $right.SourceRecordId\r\n | extend AnomalyName = \"Anomalous Role Assignment\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Account Manipulation\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may manipulate accounts to maintain access to victim systems. These actions include adding new accounts to high privileged groups. Dragonfly 2.0, for example, added newly created accounts to the administrators group to maintain elevated access. The query below generates an output of all high Blast Radius users performing Add member to privileged role, or ones that add users for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, RoleName, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; let LogOns=materialize(\r\n BehaviorAnalytics\r\n | where ActivityType == \"LogOn\");\r\nlet AnomalousResourceAccess = LogOns\r\n | where ActionType == \"ResourceAccess\"\r\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\r\n | extend AnomalyName = \"Anomalous Resource Access\",\r\n Tactic = \"Lateral Movement\",\r\n Technique = \"\",\r\n SubTechnique = \"\",\r\n Description = \"Adversary may be trying to move through the environment. APT29 and APT32, for example, has used PtH & PtT techniques to lateral move around the network. The query below generates an output of all users performing an resource access (4624:3) to devices for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousRDPActivity = LogOns\r\n | where ActionType == \"RemoteInteractiveLogon\"\r\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\r\n | extend AnomalyName = \"Anomalous RDP Activity\",\r\n Tactic = \"Lateral Movement\",\r\n Technique = \"\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. FIN10, for example, has used RDP to move laterally to systems in the victim environment. The query below generates an output of all users performing a remote interactive logon (4624:10) to a device for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousLogintoDevices = LogOns\r\n | where ActionType == \"InteractiveLogon\"\r\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\r\n | where UsersInsights.DormantAccount == true or DevicesInsights.LocalAdmin == true\r\n | extend AnomalyName = \"Anomalous Login To Devices\",\r\n Tactic = \"Privilege Escalation\",\r\n Technique = \"Valid Accounts\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may steal the credentials of a specific user or service account using Credential Access techniques or capture credentials earlier in their reconnaissance process through social engineering for means of gaining Initial Access. APT33, for example, has used valid accounts for initial access and privilege escalation. The query below generates an output of all administrator users performing an interactive logon (4624:2) to a device for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousPasswordReset = BehaviorAnalytics\r\n | where ActionType == \"Reset user password\"\r\n | where ActivityInsights.FirstTimeUserPerformedAction == \"True\"\r\n | join (\r\n AuditLogs\r\n | where OperationName == \"Reset user password\"\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | mv-expand TargetResources\r\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(TargetResources.userPrincipalName, \"#\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Password Reset\",\r\n Tactic = \"Impact\",\r\n Technique = \"Account Access Removal\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts. LockerGoga, for example, has been observed changing account passwords and logging off current users. The query below generates an output of all users performing Reset user password for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority\r\n | sort by TimeGenerated desc;\r\nlet AnomalousGeoLocationLogon = BehaviorAnalytics\r\n | where ActionType == \"Sign-in\"\r\n | where ActivityInsights.FirstTimeUserConnectedFromCountry == True and (ActivityInsights.FirstTimeConnectionFromCountryObservedInTenant == True or ActivityInsights.CountryUncommonlyConnectedFromAmongPeers == True)\r\n | join (\r\n SigninLogs\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Successful Logon\",\r\n Tactic = \"Initial Access\",\r\n Technique = \"Valid Accounts\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may steal the credentials of a specific user or service account using Credential Access techniques or capture credentials earlier in their reconnaissance process through social engineering for means of gaining Initial Access. APT33, for example, has used valid accounts for initial access. The query below generates an output of successful Sign-in performed by a user from a new geo location he has never connected from before, and none of his peers as well.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousFailedLogon = BehaviorAnalytics\r\n | where ActivityType == \"LogOn\"\r\n | where UsersInsights.BlastRadius == \"High\"\r\n | join (\r\n SigninLogs \r\n | where Status.errorCode == 50126\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Failed Logon\",\r\n Tactic = \"Credential Access\",\r\n Technique = \"Brute Force\",\r\n SubTechnique = \"Password Guessing\",\r\n Description = \"Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Emotet, for example, has been observed using a hard coded list of passwords to brute force user accounts. The query below generates an output of all users with 'High' BlastRadius that perform failed Sign-in:Invalid username or password.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousAADAccountManipulation = AuditLogs\r\n | where OperationName == \"Update user\"\r\n | mv-expand AdditionalDetails\r\n | where AdditionalDetails.key == \"UserPrincipalName\"\r\n | mv-expand TargetResources\r\n | extend RoleId = tostring(TargetResources.modifiedProperties[0].newValue)\r\n | where isnotempty(RoleId) and RoleId in (critical, high)\r\n | extend RoleName = tostring(TargetResources.modifiedProperties[1].newValue)\r\n | where isnotempty(RoleName)\r\n | extend TargetId = tostring(TargetResources.id)\r\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(TargetResources.userPrincipalName, \"#\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\r\n | join kind=inner ( \r\n BehaviorAnalytics\r\n | where ActionType == \"Update user\"\r\n | where UsersInsights.BlasrRadius == \"High\" or ActivityInsights.FirstTimeUserPerformedAction == true\r\n )\r\n on $left._ItemId == $right.SourceRecordId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName) \r\n | extend AnomalyName = \"Anomalous Account Manipulation\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Account Manipulation\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may manipulate accounts to maintain access to victim systems. These actions include adding new accounts to high privileged groups. Dragonfly 2.0, for example, added newly created accounts to the administrators group to maintain elevated access. The query below generates an output of all high Blast Radius users performing 'Update user' (name change) to privileged role, or ones that changed users for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, RoleName, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; let AnomalousAADAccountCreation = BehaviorAnalytics\r\n | where ActionType == \"Add user\"\r\n | where ActivityInsights.FirstTimeUserPerformedAction == True or ActivityInsights.FirstTimeActionPerformedInTenant == True or ActivityInsights.ActionUncommonlyPerformedAmongPeers == true\r\n | join(\r\n AuditLogs\r\n | where OperationName == \"Add user\"\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | mv-expand TargetResources\r\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(TargetResources.userPrincipalName, \"#\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\r\n | extend DisplayName = tostring(UsersInsights.AccountDisplayName),\r\n UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Account Creation\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Create Account\",\r\n SubTechnique = \"Cloud Account\",\r\n Description = \"Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system. The query below generates an output of all the users performing user creation for the first time and the target users that were created.\"\t\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority\r\n | sort by TimeGenerated desc;\r\nlet AnomalyTable = union kind=outer AnomalousSigninActivity, AnomalousRoleAssignment, AnomalousResourceAccess, AnomalousRDPActivity, AnomalousPasswordReset, AnomalousLogintoDevices, AnomalousGeoLocationLogon, AnomalousAADAccountManipulation, AnomalousAADAccountCreation, AnomalousFailedLogon;\r\nlet TopUsersByAnomalies = AnomalyTable\r\n | summarize hint.strategy = shuffle AnomalyCount=count() by UserName, UserPrincipalName, tostring(UsersInsights.OnPremSid), tostring(UsersInsights.AccountObjectId)\r\n | project Name=tolower(UserName), UPN=tolower(UserPrincipalName), AadUserId=UsersInsights_AccountObjectId, Sid=UsersInsights_OnPremSid, AnomalyCount\r\n | sort by AnomalyCount desc;\r\nlet TopUsersByIncidents = SecurityIncident\r\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n | where Status == \"New\" or Status == \"Active\"\r\n | mv-expand AlertIds\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind= innerunique ( \r\n SecurityAlert \r\n )\r\n on $left.AlertId == $right.SystemAlertId\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n | union TopUsersByAnomalies\r\n | extend \r\n AadPivot = iff(isempty(AadUserId), iff(isempty(Sid), Name, Sid), AadUserId),\r\n SidPivot = iff(isempty(Sid), iff(isempty(AadUserId), Name, AadUserId), Sid),\r\n UPNExists = iff(isempty(UPN), false, true),\r\n NameExists = iff(isempty(Name), false, true),\r\n SidExists = iff(isempty(Sid), false, true),\r\n AADExists = iff(isempty(AadUserId), false, true)\r\n | summarize hint.strategy = shuffle IncidentCount=dcount(IncidentNumber, 4), AlertCount=dcountif(AlertId, isnotempty(AlertId), 4), AnomalyCount=sum(AnomalyCount), any(Title, Severity, Status, StartTime, IncidentNumber, IncidentUrl, Owner), UPNAnchor=anyif(UPN, UPNExists == true), NameAnchor=anyif(Name, NameExists == true), AadAnchor=anyif(AadUserId, AADExists == true), SidAnchor=anyif(Sid, SidExists == true), any(SidPivot) by AadPivot\r\n | summarize hint.strategy = shuffle IncidentCount=sum(IncidentCount), AlertCount=sum(AlertCount), AnomalyCount=sum(AnomalyCount), UPNAnchor=anyif(UPNAnchor, isempty(UPNAnchor) == false), NameAnchor=anyif(NameAnchor, isempty(NameAnchor) == false), AadAnchor=anyif(AadAnchor, isempty(AadAnchor) == false), SidAnchor=anyif(SidAnchor, isempty(SidAnchor) == false), any(any_Title, any_Severity, any_StartTime, any_IncidentNumber, any_IncidentUrl) by any_SidPivot\r\n | summarize hint.strategy = shuffle IncidentCount=sum(IncidentCount), AlertCount=sum(AlertCount), AnomalyCount=sum(AnomalyCount), UPNAnchor=anyif(UPNAnchor, isempty(UPNAnchor) == false), AadAnchor=anyif(AadAnchor, isempty(AadAnchor) == false), SidAnchor=anyif(SidAnchor, isempty(SidAnchor) == false), any(any_any_Title, any_any_Severity, any_any_StartTime, any_any_IncidentNumber, any_any_IncidentUrl) by NameAnchor\r\n | project [\"UserName\"]=NameAnchor, IncidentCount, AlertCount, AnomalyCount, [\"AadUserId\"]=AadAnchor, [\"OnPremSid\"]=SidAnchor, [\"UserPrincipalName\"]=UPNAnchor;\r\nTopUsersByIncidents\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| project UserPrincipalName, IncidentCount, AlertCount, AnomalyCount\r\n| sort by AlertCount desc\r\n| limit 2500\r\n", "size": 0, "showAnalytics": true, "title": "Entity Behavior Analytics Alerts", "noDataMessage": "No results, Confirm Sentinel Entity Behavior is Enabled", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentCount", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "AlertCount", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "AnomalyCount", "formatter": 8, "formatOptions": { "palette": "yellow" } } ], "rowLimit": 2500, "filter": true, "sortBy": [ { "itemKey": "$gen_heatmap_AlertCount_2", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_heatmap_AlertCount_2", "sortOrder": 2 } ], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "query - 1", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let UncommonActionVolume = BehaviorAnalytics\r\n| extend UncommonActionVolume = tostring(ActivityInsights.UncommonHighVolumeOfActions)\r\n| where UncommonActionVolume == \"True\"\r\n| summarize count() by UserPrincipalName\r\n| project-rename UncommonActionVolume = count_;\r\nlet UncommonAction = BehaviorAnalytics\r\n| extend UncommonAction = tostring(ActivityInsights.ActionUncommonlyPerformedByUser)\r\n| where UncommonAction == \"True\"\r\n| summarize count() by UserPrincipalName\r\n| project-rename UncommonAction = count_;\r\nlet Uncommon = UncommonActionVolume | join(UncommonAction) on UserPrincipalName;\r\nlet FirstTimeDeviceLogon = BehaviorAnalytics\r\n| extend FirstTimeDeviceLogon = tostring(ActivityInsights.FirstTimeUserLoggedOnToDevice)\r\n| where FirstTimeDeviceLogon == \"True\"\r\n| summarize count() by UserPrincipalName\r\n| project-rename FirstTimeDeviceLogon = count_;\r\nlet FirstTimeUserAction = BehaviorAnalytics\r\n| extend FirstTimeUserAction = tostring(ActivityInsights.FirstTimeUserPerformedAction)\r\n| where FirstTimeUserAction == \"True\"\r\n| summarize count() by UserPrincipalName\r\n| project-rename FirstTimeUserAction = count_;\r\nlet FirstTime = FirstTimeUserAction | join(FirstTimeDeviceLogon) on UserPrincipalName;\r\nUncommon | join kind=fullouter(FirstTime) on UserPrincipalName\r\n| where UserPrincipalName <> \"\"\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| project UserPrincipalName, UncommonActionVolume, UncommonAction, FirstTimeUserAction, FirstTimeDeviceLogon\r\n| sort by UncommonActionVolume desc \r\n| limit 250\r\n\r\n", "size": 0, "showAnalytics": true, "title": "User Anomalies", "noDataMessage": "There are no results within the selected thresholds (time, workspace, subscription). See Enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel for respective UEBA configurations (https://docs.microsoft.com/azure/sentinel/enable-entity-behavior-analytics)", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "UncommonActionVolume", "formatter": 4, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "UncommonAction", "formatter": 4, "formatOptions": { "palette": "green" } }, { "columnMatch": "FirstTimeUserAction", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "FirstTimeDeviceLogon", "formatter": 4, "formatOptions": { "palette": "yellow" } }, { "columnMatch": "IncidentCount", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "AlertCount", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "AnomalyCount", "formatter": 8, "formatOptions": { "palette": "yellow" } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_bar_FirstTimeDeviceLogon_4", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_bar_FirstTimeDeviceLogon_4", "sortOrder": 2 } ], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "query - 4", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let AnomalySignIns = BehaviorAnalytics\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| extend FirstTimeDeviceLogon = tostring(ActivityInsights.FirstTimeUserLoggedOnToDevice)\r\n| extend FirstTimeUserAction = tostring(ActivityInsights.FirstTimeUserPerformedAction)\r\n| extend UncommonAction = tostring(ActivityInsights.ActionUncommonlyPerformedByUser)\r\n| extend UncommonVolumeOfActions = tostring(ActivityInsights.UncommonHighVolumeOfActions)\r\n| where FirstTimeDeviceLogon == \"True\" or FirstTimeUserAction == \"True\" or UncommonAction == \"True\" or UncommonVolumeOfActions == \"True\";\r\nAnomalySignIns | join (SigninLogs) on UserPrincipalName", "size": 3, "showAnalytics": true, "title": "Anomalous Activity by Geolocation", "noDataMessage": "There are no results within the selected thresholds (time, workspace, subscription). See Enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel for respective UEBA configurations (https://docs.microsoft.com/azure/sentinel/enable-entity-behavior-analytics)", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "map", "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "warning", "text": "{0}{1}" } ] } }, { "columnMatch": "UncommonActionVolume", "formatter": 4, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "UncommonAction", "formatter": 4, "formatOptions": { "palette": "green" } }, { "columnMatch": "FirstTimeUserAction", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "FirstTimeDeviceLogon", "formatter": 4, "formatOptions": { "palette": "yellow" } }, { "columnMatch": "IncidentCount", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "AlertCount", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "AnomalyCount", "formatter": 8, "formatOptions": { "palette": "yellow" } } ] }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "latitude_", "longitude": "longitude_", "sizeSettings": "Location", "sizeAggregation": "Count", "labelSettings": "city_", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "redBright" } ] } } }, "customWidth": "50", "name": "Results46" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let AnomalySignIns = BehaviorAnalytics\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| extend FirstTimeDeviceLogon = tostring(ActivityInsights.FirstTimeUserLoggedOnToDevice)\r\n| extend FirstTimeUserAction = tostring(ActivityInsights.FirstTimeUserPerformedAction)\r\n| extend UncommonAction = tostring(ActivityInsights.ActionUncommonlyPerformedByUser)\r\n| extend UncommonVolumeOfActions = tostring(ActivityInsights.UncommonHighVolumeOfActions)\r\n| where FirstTimeDeviceLogon == \"True\" or FirstTimeUserAction == \"True\" or UncommonAction == \"True\" or UncommonVolumeOfActions == \"True\";\r\nAnomalySignIns | join (SigninLogs) on UserPrincipalName\r\n| where SourceIPLocation <> \"\"\r\n| summarize count() by UserPrincipalName, SourceIPLocation\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Anomalous Activity by User & GeoLocation", "noDataMessage": "There are no results within the selected thresholds (time, workspace, subscription). See Enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel for respective UEBA configurations (https://docs.microsoft.com/azure/sentinel/enable-entity-behavior-analytics)", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "Location", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Globe", "text": "{0}{1}" } ] } }, { "columnMatch": "SourceIPLocation", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Globe", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "redBright" } } ], "filter": true } }, "customWidth": "50", "name": "query - 14" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AADUserRiskEvents\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| extend UserProfile = strcat(\"#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/\",UserId)\r\n| extend countryOrRegion_ = tostring(Location.countryOrRegion)\r\n| extend city_ = tostring(Location.city)\r\n| extend state_ = tostring(Location.state)\r\n| extend latitude_ = tostring(parse_json(tostring(Location.geoCoordinates)).latitude)\r\n| extend longitude_ = tostring(parse_json(tostring(Location.geoCoordinates)).longitude)\r\n| distinct UserPrincipalName, UserProfile, RiskLevel, RiskEventType, city_, state_, countryOrRegion_, UserId\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "EntraID Identity Protection: User Sign-in Risk Details", "noDataMessage": "There are no results within the selected thresholds (time, workspace, subscription). See How To: Configure and enable Microsoft Entra ID: Identity Protection risk policies (https://docs.microsoft.com/azure/active-directory/identity-protection/howto-identity-protection-configure-risk-policies)", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "UserProfile", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "EntraID User Profile >>", "bladeOpenContext": { "bladeName": "UserDetailsMenuBlade", "extensionName": "Microsoft_AAD_IAM", "bladeParameters": [ { "name": "userId", "source": "column", "value": "UserId" } ] } } }, { "columnMatch": "RiskLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "high", "representation": "Sev0", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "medium", "representation": "Sev1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "low", "representation": "Sev2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Sev3", "text": "{0}{1}" } ] } }, { "columnMatch": "UserId", "formatter": 5 } ], "filter": true } }, "name": "query - 14" } ] }, "conditionalVisibility": { "parameterName": "isUEBAVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Entity Insights" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Watchlists](https://docs.microsoft.com/azure/sentinel/watchlists)\n---\n\nMicrosoft Sentinel watchlists enable the collection of data from external data sources for correlation with the events in your Microsoft Sentinel environment. Once created, you can use watchlists in your search, detection rules, threat hunting, and response playbooks. Watchlists are stored in your Microsoft Sentinel workspace as name-value pairs and are cached for optimal query performance and low latency. This section's panels require Microsoft Sentinel Watchlists. Your available Watchlists are displayed in the first panel below, if this panel is blank, configure watchlists as needed. This section requires that Watchlists are configured with use of the SearchKey column which groups queries to UserPrincipalName, AADEmail, Caller and respective user identifier fields. For more information, see 💡[Use Watchlists in Queries](https://docs.microsoft.com/azure/sentinel/watchlists#use-watchlists-in-queries). \n\n\n\n" }, "name": "text - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "4a388baf-b1ed-4d69-9b31-58039271c260", "linkTarget": "OpenBlade", "linkLabel": "Watchlist", "style": "secondary", "bladeOpenContext": { "bladeName": "WatchlistBlade", "extensionName": "Microsoft_Azure_SentinelUS", "bladeParameters": [ { "name": "subscriptionId", "source": "parameter", "value": "Subscription" }, { "name": "resourceGroup", "source": "parameter", "value": "DefaultSubscription_Internal" }, { "name": "workspaceName", "source": "parameter", "value": "Workspace" } ] } } ] }, "customWidth": "50", "name": "EL0" } ] }, "customWidth": "40", "name": "group - 44" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 44" }, { "type": 1, "content": { "json": "| Watchlist Queries | | |\r\n|:--| - | - |\r\n| Watchlist: Sign-ins by Location Over Time | Watchlist: Entity Behavior Analytics Alerts| Watchlist: Authentication Details|\r\n| Watchlist: Account Blast Radius | Watchlist: Audit Logs | Watchlist: Anomalous Apps Based on User's Authentication Location|\r\n| Watchlist: Searching for VIP Indicators/Emails| Watchlist: Multiple Failed Queries | Watchlist: Searching for Sensitive Word List |\r\n| Watchlist: Excessive Granting Privileges to Accounts | Watchlist: Sign-in Authentication Failures | Watchlist: Deleting or Removing Assets |\r\n| Watchlist: Privileged Identity Management Actions | Watchlist: Failed Attempts to Access a Microsoft Portal | Watchlist: Office Workload Operations |\r\n| Watchlist: Office Mail Forwarding | Watchlist: Sensitive Data Access |\r\n\r\nThis section is bound by the above parameters for Subscription, Workspace, TimeRange, and User. Panels are dynamically displayed meaning numerous queries are executed and only panels returning data are displayed. " }, "customWidth": "40", "name": "Watchlist" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "3ed0bed7-469e-4200-9b3c-6260a7d81bd0", "version": "KqlParameterItem/1.0", "name": "Watchlist", "label": "🔀 Watchlist Selector", "type": 2, "isRequired": true, "query": "Watchlist\r\n| where TimeGenerated > ago(90d)\r\n| where WatchlistAlias <> \"\"\r\n| distinct WatchlistAlias", "crossComponentResources": [ "{Workspace}" ], "value": "CriticalNetworkIP", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "100", "name": "Watchlist Selector Parameter" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Watchlist\r\n| where TimeGenerated > ago(90d)\r\n| where WatchlistAlias <> \"\"\r\n| distinct WatchlistAlias", "size": 0, "showAnalytics": true, "title": "Available Watchlists", "noDataMessage": "You don't have any Watchlists configured. For more information on setting up watchlists, see https://docs.microsoft.com/azure/sentinel/watchlists", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true, "sortBy": [ { "itemKey": "WatchlistAlias", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "WatchlistAlias", "sortOrder": 1 } ], "tileSettings": { "titleContent": { "columnMatch": "WatchlistAlias", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, "showBorder": false } }, "customWidth": "50", "name": "Available Watchlists", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Watchlist\r\n| where WatchlistAlias == '{Watchlist}'\r\n| distinct SearchKey", "size": 0, "showAnalytics": true, "title": "Selected Watchlist", "noDataMessage": "No Watchlist Selected", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "WatchlistAlias", "formatter": 7 } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "WatchlistAlias", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, "showBorder": false } }, "customWidth": "50", "name": "Selected Watchlist", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n | mv-expand AlertIds\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind= innerunique ( \r\n SecurityAlert \r\n )\r\n on $left.AlertId == $right.SystemAlertId\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n| extend Href_ = tostring(parse_json(ExtendedLinks)[0].Href)\r\n| where UPN <> \"\"\r\n| join kind=inner (Watchlist|where WatchlistAlias == '{Watchlist}')\r\non $left.UPN == $right.SearchKey\r\n| extend UserPrincipalName=UPN\r\n| distinct UserPrincipalName, AlertName, Severity, AlertLink, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "Security Alerts", "noDataMessage": "No Results Confirm Watchlists are Configured", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Alert", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "Sev0", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "Sev1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "Sev2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Sev3", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Alert >" } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "name": "Results113f" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n | mv-expand AlertIds\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind= innerunique ( \r\n SecurityAlert \r\n )\r\n on $left.AlertId == $right.SystemAlertId\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n| extend Href_ = tostring(parse_json(ExtendedLinks)[0].Href)\r\n| where UPN <> \"\"\r\n| join kind=inner (Watchlist|where WatchlistAlias == '{Watchlist}')\r\non $left.UPN == $right.SearchKey\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| extend UserPrincipalName=UPN\r\n| parse IncidentUrl with * '/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| distinct UserPrincipalName, Title, Severity, IncidentBlade, IncidentNumber, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "Security Incidents", "noDataMessage": "No Results Confirm Watchlists are Configured", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "Title", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Alert", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "Sev0", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "Sev1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "Sev2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Sev3", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentBlade", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "Incident >>", "bladeOpenContext": { "bladeName": "CaseBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "id", "source": "column", "value": "IncidentBlade" } ] } } }, { "columnMatch": "UPN", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "ProductName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } } ], "filter": true, "sortBy": [ { "itemKey": "IncidentNumber", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "IncidentNumber", "sortOrder": 2 } ], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "name": "Results153" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Watchlist = Watchlist | where WatchlistAlias == '{Watchlist}';\r\nSigninLogs\r\n| join kind=inner Watchlist\r\non $left.UserPrincipalName == $right.SearchKey\r\n| where IsInteractive == true\r\n| extend city_ = tostring(LocationDetails.city)\r\n| extend state_ = tostring(LocationDetails.state)\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by state_\r\n| render timechart\r\n", "size": 0, "showAnalytics": true, "title": "Watchlist: Sign-ins by Location Over Time", "noDataMessage": "No Results Confirm Watchlists are Configured", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ] }, "sortBy": [], "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "name": "Results27" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Watchlist = Watchlist | where WatchlistAlias == '{Watchlist}';\r\nlet AnomalousSigninActivity = BehaviorAnalytics\r\n | where ActionType == \"Sign-in\"\r\n | where (UsersInsights.NewAccount == True or UsersInsights.DormantAccount == True) and (\r\n ActivityInsights.FirstTimeUserAccessedResource == True and ActivityInsights.ResourceUncommonlyAccessedAmongPeers == True\r\n or ActivityInsights.FirstTimeUserUsedApp == True and ActivityInsights.AppUncommonlyUsedAmongPeers == False)\r\n | join (\r\n SigninLogs | where Status.errorCode == 0 or Status.errorCode == 0 and RiskDetail != \"none\"\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Successful Logon\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Valid Accounts\",\r\n SubTechnique = \"\",\r\n Description = \"Successful Sign-in with one or more of the following indications: sign by new or recently dormant accounts and sign in with resource for the first time (while none of their peers did) or to an app for the first time (while none of their peers did) or performed by a user with Risk indication from AAD\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet critical = dynamic(['9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3', 'c4e39bd9-1100-46d3-8c65-fb160da0071f', '158c047a-c907-4556-b7ef-446551a6b5f7', '62e90394-69f5-4237-9190-012177145e10', 'd29b2b05-8046-44ba-8758-1e26182fcf32', '729827e3-9c14-49f7-bb1b-9608f156bbb8', '966707d0-3269-4727-9be2-8c3a10f19b9d', '194ae4cb-b126-40b2-bd5b-6091b380977d', 'fe930be7-5e62-47db-91af-98c3a49a38b1']);\r\nlet high = dynamic(['cf1c38e5-3621-4004-a7cb-879624dced7c', '7495fdc4-34c4-4d15-a289-98788ce399fd', 'aaf43236-0c0d-4d5f-883a-6955382ac081', '3edaf663-341e-4475-9f94-5c398ef6c070', '7698a772-787b-4ac8-901f-60d6b08affd2', 'b1be1c3e-b65d-4f19-8427-f6fa0d97feb9', '9f06204d-73c1-4d4c-880a-6edb90606fd8', '29232cdf-9323-42fd-ade2-1d097af3e4de', 'be2f45a1-457d-42af-a067-6ec1fa63bc45', '7be44c8a-adaf-4e2a-84d6-ab2649e08a13', 'e8611ab8-c189-46e8-94e1-60213ab1f814']);//insider\r\nlet AnomalousRoleAssignment = AuditLogs\r\n | where TimeGenerated > ago(28d)\r\n | where OperationName == \"Add member to role\"\r\n | mv-expand TargetResources\r\n | extend RoleId = tostring(TargetResources.modifiedProperties[0].newValue)\r\n | where isnotempty(RoleId) and RoleId in (critical, high)\r\n | extend RoleName = tostring(TargetResources.modifiedProperties[1].newValue)\r\n | where isnotempty(RoleName)\r\n | extend TargetId = tostring(TargetResources.id)\r\n | extend Target = tostring(TargetResources.userPrincipalName)\r\n | join kind=inner (\r\n BehaviorAnalytics\r\n | where ActionType == \"Add member to role\"\r\n | where UsersInsights.BlasrRadius == \"High\" or ActivityInsights.FirstTimeUserPerformedAction == true\r\n )\r\n on $left._ItemId == $right.SourceRecordId\r\n | extend AnomalyName = \"Anomalous Role Assignment\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Account Manipulation\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may manipulate accounts to maintain access to victim systems. These actions include adding new accounts to high privileged groups. Dragonfly 2.0, for example, added newly created accounts to the administrators group to maintain elevated access. The query below generates an output of all high Blast Radius users performing Add member to privileged role, or ones that add users for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, RoleName, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; let LogOns=materialize(\r\n BehaviorAnalytics\r\n | where ActivityType == \"LogOn\");\r\nlet AnomalousResourceAccess = LogOns\r\n | where ActionType == \"ResourceAccess\"\r\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\r\n | extend AnomalyName = \"Anomalous Resource Access\",\r\n Tactic = \"Lateral Movement\",\r\n Technique = \"\",\r\n SubTechnique = \"\",\r\n Description = \"Adversary may be trying to move through the environment. APT29 and APT32, for example, has used PtH & PtT techniques to lateral move around the network. The query below generates an output of all users performing an resource access (4624:3) to devices for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousRDPActivity = LogOns\r\n | where ActionType == \"RemoteInteractiveLogon\"\r\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\r\n | extend AnomalyName = \"Anomalous RDP Activity\",\r\n Tactic = \"Lateral Movement\",\r\n Technique = \"\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. FIN10, for example, has used RDP to move laterally to systems in the victim environment. The query below generates an output of all users performing a remote interactive logon (4624:10) to a device for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousLogintoDevices = LogOns\r\n | where ActionType == \"InteractiveLogon\"\r\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\r\n | where UsersInsights.DormantAccount == true or DevicesInsights.LocalAdmin == true\r\n | extend AnomalyName = \"Anomalous Login To Devices\",\r\n Tactic = \"Privilege Escalation\",\r\n Technique = \"Valid Accounts\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may steal the credentials of a specific user or service account using Credential Access techniques or capture credentials earlier in their reconnaissance process through social engineering for means of gaining Initial Access. APT33, for example, has used valid accounts for initial access and privilege escalation. The query below generates an output of all administrator users performing an interactive logon (4624:2) to a device for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousPasswordReset = BehaviorAnalytics\r\n | where ActionType == \"Reset user password\"\r\n | where ActivityInsights.FirstTimeUserPerformedAction == \"True\"\r\n | join (\r\n AuditLogs\r\n | where OperationName == \"Reset user password\"\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | mv-expand TargetResources\r\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(TargetResources.userPrincipalName, \"#\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Password Reset\",\r\n Tactic = \"Impact\",\r\n Technique = \"Account Access Removal\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts. LockerGoga, for example, has been observed changing account passwords and logging off current users. The query below generates an output of all users performing Reset user password for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority\r\n | sort by TimeGenerated desc;\r\nlet AnomalousGeoLocationLogon = BehaviorAnalytics\r\n | where ActionType == \"Sign-in\"\r\n | where ActivityInsights.FirstTimeUserConnectedFromCountry == True and (ActivityInsights.FirstTimeConnectionFromCountryObservedInTenant == True or ActivityInsights.CountryUncommonlyConnectedFromAmongPeers == True)\r\n | join (\r\n SigninLogs\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Successful Logon\",\r\n Tactic = \"Initial Access\",\r\n Technique = \"Valid Accounts\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may steal the credentials of a specific user or service account using Credential Access techniques or capture credentials earlier in their reconnaissance process through social engineering for means of gaining Initial Access. APT33, for example, has used valid accounts for initial access. The query below generates an output of successful Sign-in performed by a user from a new geo location he has never connected from before, and none of his peers as well.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousFailedLogon = BehaviorAnalytics\r\n | where ActivityType == \"LogOn\"\r\n | where UsersInsights.BlastRadius == \"High\"\r\n | join (\r\n SigninLogs \r\n | where Status.errorCode == 50126\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Failed Logon\",\r\n Tactic = \"Credential Access\",\r\n Technique = \"Brute Force\",\r\n SubTechnique = \"Password Guessing\",\r\n Description = \"Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Emotet, for example, has been observed using a hard coded list of passwords to brute force user accounts. The query below generates an output of all users with 'High' BlastRadius that perform failed Sign-in:Invalid username or password.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousAADAccountManipulation = AuditLogs\r\n | where OperationName == \"Update user\"\r\n | mv-expand AdditionalDetails\r\n | where AdditionalDetails.key == \"UserPrincipalName\"\r\n | mv-expand TargetResources\r\n | extend RoleId = tostring(TargetResources.modifiedProperties[0].newValue)\r\n | where isnotempty(RoleId) and RoleId in (critical, high)\r\n | extend RoleName = tostring(TargetResources.modifiedProperties[1].newValue)\r\n | where isnotempty(RoleName)\r\n | extend TargetId = tostring(TargetResources.id)\r\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(TargetResources.userPrincipalName, \"#\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\r\n | join kind=inner ( \r\n BehaviorAnalytics\r\n | where ActionType == \"Update user\"\r\n | where UsersInsights.BlasrRadius == \"High\" or ActivityInsights.FirstTimeUserPerformedAction == true\r\n )\r\n on $left._ItemId == $right.SourceRecordId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName) \r\n | extend AnomalyName = \"Anomalous Account Manipulation\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Account Manipulation\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may manipulate accounts to maintain access to victim systems. These actions include adding new accounts to high privileged groups. Dragonfly 2.0, for example, added newly created accounts to the administrators group to maintain elevated access. The query below generates an output of all high Blast Radius users performing 'Update user' (name change) to privileged role, or ones that changed users for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, RoleName, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; let AnomalousAADAccountCreation = BehaviorAnalytics\r\n | where ActionType == \"Add user\"\r\n | where ActivityInsights.FirstTimeUserPerformedAction == True or ActivityInsights.FirstTimeActionPerformedInTenant == True or ActivityInsights.ActionUncommonlyPerformedAmongPeers == true\r\n | join(\r\n AuditLogs\r\n | where OperationName == \"Add user\"\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | mv-expand TargetResources\r\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(TargetResources.userPrincipalName, \"#\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\r\n | extend DisplayName = tostring(UsersInsights.AccountDisplayName),\r\n UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Account Creation\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Create Account\",\r\n SubTechnique = \"Cloud Account\",\r\n Description = \"Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system. The query below generates an output of all the users performing user creation for the first time and the target users that were created.\"\t\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority\r\n | sort by TimeGenerated desc;\r\nlet AnomalyTable = union kind=outer AnomalousSigninActivity, AnomalousRoleAssignment, AnomalousResourceAccess, AnomalousRDPActivity, AnomalousPasswordReset, AnomalousLogintoDevices, AnomalousGeoLocationLogon, AnomalousAADAccountManipulation, AnomalousAADAccountCreation, AnomalousFailedLogon;\r\nlet TopUsersByAnomalies = AnomalyTable\r\n | summarize hint.strategy = shuffle AnomalyCount=count() by UserName, UserPrincipalName, tostring(UsersInsights.OnPremSid), tostring(UsersInsights.AccountObjectId)\r\n | project Name=tolower(UserName), UPN=tolower(UserPrincipalName), AadUserId=UsersInsights_AccountObjectId, Sid=UsersInsights_OnPremSid, AnomalyCount\r\n | sort by AnomalyCount desc;\r\nlet TopUsersByIncidents = SecurityIncident\r\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n | where Status == \"New\" or Status == \"Active\"\r\n | mv-expand AlertIds\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind= innerunique ( \r\n SecurityAlert \r\n )\r\n on $left.AlertId == $right.SystemAlertId\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n | union TopUsersByAnomalies\r\n | extend \r\n AadPivot = iff(isempty(AadUserId), iff(isempty(Sid), Name, Sid), AadUserId),\r\n SidPivot = iff(isempty(Sid), iff(isempty(AadUserId), Name, AadUserId), Sid),\r\n UPNExists = iff(isempty(UPN), false, true),\r\n NameExists = iff(isempty(Name), false, true),\r\n SidExists = iff(isempty(Sid), false, true),\r\n AADExists = iff(isempty(AadUserId), false, true)\r\n | summarize hint.strategy = shuffle IncidentCount=dcount(IncidentNumber, 4), AlertCount=dcountif(AlertId, isnotempty(AlertId), 4), AnomalyCount=sum(AnomalyCount), any(Title, Severity, Status, StartTime, IncidentNumber, IncidentUrl, Owner), UPNAnchor=anyif(UPN, UPNExists == true), NameAnchor=anyif(Name, NameExists == true), AadAnchor=anyif(AadUserId, AADExists == true), SidAnchor=anyif(Sid, SidExists == true), any(SidPivot) by AadPivot\r\n | summarize hint.strategy = shuffle IncidentCount=sum(IncidentCount), AlertCount=sum(AlertCount), AnomalyCount=sum(AnomalyCount), UPNAnchor=anyif(UPNAnchor, isempty(UPNAnchor) == false), NameAnchor=anyif(NameAnchor, isempty(NameAnchor) == false), AadAnchor=anyif(AadAnchor, isempty(AadAnchor) == false), SidAnchor=anyif(SidAnchor, isempty(SidAnchor) == false), any(any_Title, any_Severity, any_StartTime, any_IncidentNumber, any_IncidentUrl) by any_SidPivot\r\n | summarize hint.strategy = shuffle IncidentCount=sum(IncidentCount), AlertCount=sum(AlertCount), AnomalyCount=sum(AnomalyCount), UPNAnchor=anyif(UPNAnchor, isempty(UPNAnchor) == false), AadAnchor=anyif(AadAnchor, isempty(AadAnchor) == false), SidAnchor=anyif(SidAnchor, isempty(SidAnchor) == false), any(any_any_Title, any_any_Severity, any_any_StartTime, any_any_IncidentNumber, any_any_IncidentUrl) by NameAnchor\r\n | project [\"UserName\"]=NameAnchor, IncidentCount, AlertCount, AnomalyCount, [\"AadUserId\"]=AadAnchor, [\"OnPremSid\"]=SidAnchor, [\"UserPrincipalName\"]=UPNAnchor;\r\nTopUsersByIncidents\r\n| sort by AlertCount desc\r\n| join kind=inner (Watchlist)\r\non $left.UserPrincipalName == $right.SearchKey\r\n| project UserPrincipalName, IncidentCount, AlertCount, AnomalyCount\r\n| sort by IncidentCount desc\r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "Watchlist: Entity Behavior Analytics Alerts", "noDataMessage": "No Results Confirm Watchlists are Configured", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "PersonWithFriend", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentCount", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "AlertCount", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "AnomalyCount", "formatter": 8, "formatOptions": { "palette": "yellow" } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_heatmap_IncidentCount_1", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_heatmap_IncidentCount_1", "sortOrder": 2 } ] }, "customWidth": "50", "name": "Results28", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Watchlist = Watchlist | where WatchlistAlias == '{Watchlist}';\r\nlet nonInteractive = AADNonInteractiveUserSignInLogs\r\n| extend LocationDetails = parse_json(LocationDetails)\r\n| extend Status = parse_json(Status);\r\nlet data = \r\nunion SigninLogs,nonInteractive\r\n|extend errorCode = Status.errorCode\r\n|extend SigninStatus = case(errorCode == 0, \"Success\", errorCode == 50058, \"Pending user action\",errorCode == 50140, \"Pending user action\", errorCode == 51006, \"Pending user action\", errorCode == 50059, \"Pending user action\",errorCode == 65001, \"Pending user action\", errorCode == 52004, \"Pending user action\", errorCode == 50055, \"Pending user action\", errorCode == 50144, \"Pending user action\", errorCode == 50072, \"Pending user action\", errorCode == 50074, \"Pending user action\", errorCode == 16000, \"Pending user action\", errorCode == 16001, \"Pending user action\", errorCode == 16003, \"Pending user action\", errorCode == 50127, \"Pending user action\", errorCode == 50125, \"Pending user action\", errorCode == 50129, \"Pending user action\", errorCode == 50143, \"Pending user action\", errorCode == 81010, \"Pending user action\", errorCode == 81014, \"Pending user action\", errorCode == 81012 ,\"Pending user action\", \"Failure\");\r\ndata\r\n| join kind=inner (Watchlist)\r\non $left.UserPrincipalName == $right.SearchKey\r\n| where IsInteractive == true\r\n| summarize Count = count() by SigninStatus\r\n| join kind = fullouter (datatable(SigninStatus:string)['Success', 'Pending action (Interrupts)', 'Failure']) on SigninStatus\r\n| project SigninStatus = iff(SigninStatus == '', SigninStatus1, SigninStatus), Count = iff(SigninStatus == '', 0, Count)\r\n| join kind = inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SigninStatus)\r\n on SigninStatus\r\n| project-away SigninStatus1, TimeGenerated\r\n| extend Status = SigninStatus\r\n| union (\r\n data \r\n | summarize Count = count()\r\n | extend jkey = 1\r\n | join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n | extend jkey = 1) on jkey\r\n | extend SigninStatus = 'All Sign-ins', Status = '*' \r\n)\r\n| where SigninStatus <> \"All Sign-ins\"\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Watchlist: Authentication Details", "noDataMessage": "No Results Confirm Watchlists are Configured", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "User", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "info", "text": "{0}{1}" } ] } }, { "columnMatch": "Activities", "formatter": 8, "formatOptions": { "palette": "blue" } } ] }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "Results29", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Watchlist = Watchlist | where WatchlistAlias == '{Watchlist}';\r\nBehaviorAnalytics\r\n| join kind=inner (Watchlist)\r\non $left.UserPrincipalName == $right.SearchKey\r\n| extend ActionUncommonlyPerformedByUser_ = tostring(ActivityInsights.ActionUncommonlyPerformedByUser)\r\n| extend FirstTimeUserConnectedViaISP_ = tostring(ActivityInsights.FirstTimeUserConnectedViaISP)\r\n| extend ISPUncommonlyUsedAmongPeers_ = tostring(ActivityInsights.ISPUncommonlyUsedAmongPeers)\r\n| extend UncommonHighVolumeOfActions_ = tostring(ActivityInsights.UncommonHighVolumeOfActions)\r\n| extend BlastRadius_ = tostring(UsersInsights.BlastRadius)\r\n| summarize count() by UserPrincipalName, BlastRadius_\r\n| project UserPrincipalName, BlastRadius_\r\n| limit 250\r\n\r\n\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Watchlist: Account Blast Radius", "noDataMessage": "No Results Confirm Watchlists are Configured", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "PersonWithFriend", "text": "{0}{1}" } ] } }, { "columnMatch": "BlastRadius_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "blue", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "Results30", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Watchlist = Watchlist | where WatchlistAlias == '{Watchlist}';\r\nAzureActivity\r\n| join kind=inner (Watchlist)\r\non $left.Caller == $right.SearchKey\r\n| summarize count() by Caller, OperationName\r\n| sort by count_ desc \r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "Watchlist: Audit Logs", "noDataMessage": "No Results Confirm Watchlists are Configured", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Caller", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "PersonWithFriend", "text": "{0}{1}" } ] } }, { "columnMatch": "OperationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "info", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "Results31", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let azureSignIns = \r\n SigninLogs\r\n | join kind=inner (Watchlist|where WatchlistAlias == '{Watchlist}')\r\non $left.UserPrincipalName == $right.SearchKey\r\n | where SourceSystem == \"Azure AD\"\r\n | where OperationName == \"Sign-in activity\"\r\n | project TimeGenerated, OperationName, AppDisplayName, Identity, UserId, UserPrincipalName, Location, LocationDetails, \r\n ClientAppUsed, DeviceDetail, ConditionalAccessPolicies;\r\nazureSignIns\r\n| extend locationString = strcat(tostring(LocationDetails[\"countryOrRegion\"]), \"/\", \r\n tostring(LocationDetails[\"state\"]), \"/\", tostring(LocationDetails[\"city\"]), \";\", tostring(LocationDetails[\"geoCoordinates\"]))\r\n| summarize rawSigninCount = count(), countByAccount = dcount(UserId), locationCount = dcount(locationString) by AppDisplayName\r\n// tail - pick a threshold to rule out the very-high volume Azure AD apps\r\n| where rawSigninCount < 1000\r\n// more locations than accounts\r\n| where locationCount > countByAccount\r\n// almost as many / more locations than sign-ins!\r\n| where 1.0 * rawSigninCount / locationCount > 0.8 \r\n| order by rawSigninCount desc\r\n| join kind = leftouter (\r\n azureSignIns \r\n )\r\n on AppDisplayName \r\n| project AppDisplayName, TimeGenerated, Identity, rawSigninCount, countByAccount, locationCount, \r\n locationString = strcat(tostring(LocationDetails[\"countryOrRegion\"]), \"/\", tostring(LocationDetails[\"state\"]), \"/\", \r\n tostring(LocationDetails[\"city\"]), \";\", tostring(LocationDetails[\"geoCoordinates\"])), UserPrincipalName\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by Identity\r\n| render timechart", "size": 0, "showAnalytics": true, "title": "Watchlist: Anomalous Apps Based on Authentication Location ", "noDataMessage": "No Results Confirm Watchlists are Configured", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentCount", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "AlertCount", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "AnomalyCount", "formatter": 8, "formatOptions": { "palette": "yellow" } }, { "columnMatch": "UserName", "formatter": 16, "formatOptions": { "showIcon": true } } ] }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "Results32", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let viplist = dynamic(['vipuser1@example.com','vipuser2@example.com','vipuser3@example.com']); //Update with VIP User Email Addresses\r\n LAQueryLogs\r\n| join kind=inner (Watchlist|where WatchlistAlias == '{Watchlist}')\r\non $left.AADEmail == $right.SearchKey\r\n | where QueryText has_any (viplist)\r\n | project AADEmail, QueryText, RequestTarget, TimeGenerated\r\n | sort by TimeGenerated desc\r\n | limit 250\r\n ", "size": 0, "showAnalytics": true, "title": "Watchlist: Searching for VIP Indicators/Emails ", "noDataMessage": "No Results Confirm Watchlists are Configured", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AADEmail", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "PersonWithFriend", "text": "{0}{1}" } ] } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentCount", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "AlertCount", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "AnomalyCount", "formatter": 8, "formatOptions": { "palette": "yellow" } }, { "columnMatch": "UserName", "formatter": 16, "formatOptions": { "showIcon": true } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "Results33", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lookback = {TimeRange:grain};\r\n let timeframe = 1h;\r\n let threshold = 3; //Adjust failure threshold as needed\r\n LAQueryLogs\r\n | where TimeGenerated > ago(lookback)\r\n | where ResponseCode != 200\r\n | summarize count() by AADEmail, bin(TimeGenerated, timeframe)\r\n | where count_ > threshold\r\n | join kind=rightsemi (\r\n LAQueryLogs\r\n | where TimeGenerated > ago(lookback)\r\n | summarize make_set(QueryText) by AADEmail, bin(TimeGenerated, timeframe))\r\n on AADEmail, TimeGenerated\r\n| join kind=inner (Watchlist|where WatchlistAlias == '{Watchlist}')\r\non $left.AADEmail == $right.SearchKey\r\n| summarize count() by AADEmail\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Watchlist: Multiple Failed Queries", "noDataMessage": "No Results Confirm Watchlists are Configured", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AADEmail", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "PersonWithFriend", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "redBright" } } ] }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "Results34", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " let wordlist = dynamic(['example']); //Update with respective wordlists\r\n LAQueryLogs\r\n | where QueryText has_any (wordlist)\r\n| join kind=inner (Watchlist|where WatchlistAlias == '{Watchlist}')\r\non $left.AADEmail == $right.SearchKey\r\n | project TimeGenerated, AADEmail, RequestClientApp, QueryText, ResponseRowCount, RequestTarget\r\n | project AADEmail,QueryText, TimeGenerated\r\n | summarize count() by AADEmail,QueryText\r\n | sort by count_ desc\r\n | limit 250\r\n", "size": 0, "showAnalytics": true, "title": "Watchlist: Searching for Sensitive Word List", "noDataMessage": "No Results Confirm Watchlists are Configured", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AADEmail", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "PersonWithFriend", "text": "{0}{1}" } ] } }, { "columnMatch": "QueryText", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "blue" } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "Results35", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where OperationName == \"Create role assignment\"\r\n| where ActivityStatus == \"Succeeded\" \r\n| project Caller, CallerIpAddress\r\n| evaluate basket()\r\n| join kind=leftouter (AzureActivity\r\n | where OperationName == \"Create role assignment\"\r\n | where ActivityStatus == \"Succeeded\"\r\n | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by Caller, CallerIpAddress)\r\n on Caller, CallerIpAddress\r\n| project-away Caller1, CallerIpAddress1\r\n| extend timestamp = StartTime, AccountCustomEntity = Caller, IPCustomEntity = CallerIpAddress\r\n| lookup kind=inner _GetWatchlist('{Watchlist}')\r\non $left.Caller == $right.SearchKey\r\n| extend GrantedPrivileges = Caller\r\n| project Caller, GrantedPrivileges, timestamp\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Watchlist: Excessive Granting Privileges to Accounts", "noDataMessage": "No Results Confirm Watchlists are Configured", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Caller", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "GrantedPrivileges", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "AADEmail", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "QueryText", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "red", "text": "{0}{1}" } ] } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "Results36", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| extend ResultText = case(isnotempty(ResultDescription), ResultDescription, ResultType == 0 and isempty(ResultDescription), \"Successful login\", \"unknown\")\r\n| where ResultText !contains \"success\"\r\n| lookup kind=inner _GetWatchlist('{Watchlist}')\r\non $left.UserPrincipalName == $right.SearchKey\r\n| summarize count() by UserPrincipalName, ResultDescription, AppDisplayName, ConditionalAccessStatus\r\n| sort by count_ desc\r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "Watchlist: Sign-in Authentication Failures", "noDataMessage": "No Results Confirm Watchlists are Configured", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "PersonWithFriend", "text": "{0}{1}" } ] } }, { "columnMatch": "ResultDescription", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Important", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "userPrincipalName_", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "OperationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "AADEmail", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "warning", "text": "{0}{1}" } ] } }, { "columnMatch": "QueryText", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "yellow", "text": "{0}{1}" } ] } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "Results37", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where OperationName contains \"delete\" or OperationName contains \"remove\"\r\n| lookup kind=inner _GetWatchlist('{Watchlist}')\r\non $left.Caller == $right.SearchKey\r\n| project Caller, OperationName, ActivityStatus, ResourceId, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "Watchlist: Deleting or Removing Assets", "noDataMessage": "No Results Confirm Watchlists are Configured", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Caller", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "PersonWithFriend", "text": "{0}{1}" } ] } }, { "columnMatch": "ActivityStatus", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Succeeded", "representation": "success", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Failed", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Started", "representation": "pending", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "unknown", "text": "{0}{1}" } ] } }, { "columnMatch": "AADEmail", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "warning", "text": "{0}{1}" } ] } }, { "columnMatch": "QueryText", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "yellow", "text": "{0}{1}" } ] } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "Results38", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| where Identity == \"MS-PIM\"\r\n| extend userPrincipalName_ = tostring(TargetResources[0].userPrincipalName)\r\n| project userPrincipalName_, OperationName\r\n| lookup kind=inner _GetWatchlist('{Watchlist}')\r\non $left.userPrincipalName_ == $right.SearchKey\r\n| summarize count() by userPrincipalName_,OperationName\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Watchlist: Privileged Identity Management Actions", "noDataMessage": "No Results Confirm Watchlists are Configured", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "userPrincipalName_", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "PersonWithFriend", "text": "{0}{1}" } ] } }, { "columnMatch": "OperationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "AADEmail", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "warning", "text": "{0}{1}" } ] } }, { "columnMatch": "QueryText", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "yellow", "text": "{0}{1}" } ] } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "Results39", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| where AppDisplayName contains \"Portal\"\r\n// 50126 - Invalid username or password, or invalid on-premises username or password.\r\n// 50020? - The user doesn't exist in the tenant.\r\n| where ResultType in (\"50126\", \"50020\")\r\n| extend OS = DeviceDetail.operatingSystem, Browser = DeviceDetail.browser\r\n| extend StatusCode = tostring(Status.errorCode), StatusDetails = tostring(Status.additionalDetails)\r\n| extend State = tostring(LocationDetails.state), City = tostring(LocationDetails.city)\r\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), IPAddresses = makeset(IPAddress), DistinctIPCount = dcount(IPAddress), \r\n makeset(OS), makeset(Browser), makeset(City), AttemptCount = count() \r\n by UserDisplayName, UserPrincipalName, AppDisplayName, ResultType, ResultDescription, StatusCode, StatusDetails, Location, State\r\n| extend timestamp = StartTimeUtc, AccountCustomEntity = UserPrincipalName\r\n| sort by AttemptCount\r\n| lookup kind=inner _GetWatchlist('{Watchlist}')\r\non $left.UserPrincipalName == $right.SearchKey\r\n| summarize count() by UserPrincipalName, AppDisplayName\r\n| sort by count_ desc\r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "Watchlist: Failed Attempts to Access a Microsoft Portal", "noDataMessage": "No Results Confirm Watchlists are Configured", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "userPrincipalName_", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "OperationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "AADEmail", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "warning", "text": "{0}{1}" } ] } }, { "columnMatch": "QueryText", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "yellow", "text": "{0}{1}" } ] } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "Results40", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| lookup kind=inner _GetWatchlist('{Watchlist}')\r\non $left.UserId == $right.SearchKey\r\n| summarize count() by UserId, Operation, OfficeWorkload\r\n| sort by count_ desc\r\n| limit 250\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Watchlist: Office Workload Operations", "noDataMessage": "No Results Confirm Watchlists are Configured", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "PersonWithFriend", "text": "{0}{1}" } ] } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "AADEmail", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "warning", "text": "{0}{1}" } ] } }, { "columnMatch": "QueryText", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "yellow", "text": "{0}{1}" } ] } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "Results41", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| lookup kind=inner _GetWatchlist('{Watchlist}')\r\non $left.UserId == $right.SearchKey\r\n| where (Operation =~ \"Set-Mailbox\" and Parameters contains 'ForwardingSmtpAddress') \r\n or (Operation =~ 'New-InboxRule' and Parameters contains 'ForwardTo')\r\n| extend parsed=parse_json(Parameters)\r\n| extend fwdingDestination_initial = (iif(Operation =~ \"Set-Mailbox\", tostring(parsed[1].Value), tostring(parsed[2].Value)))\r\n| where isnotempty(fwdingDestination_initial)\r\n| extend fwdingDestination = iff(fwdingDestination_initial has \"smtp\", (split(fwdingDestination_initial, \":\")[1]), fwdingDestination_initial)\r\n| parse fwdingDestination with * '@' ForwardedtoDomain \r\n| parse UserId with *'@' UserDomain\r\n| extend subDomain = ((split(strcat(tostring(split(UserDomain, '.')[-2]), '.', tostring(split(UserDomain, '.')[-1])), '.')[0]))\r\n| where ForwardedtoDomain !contains subDomain\r\n| extend Result = iff(ForwardedtoDomain != UserDomain, \"Mailbox rule created to forward to External Domain\", \"Forward rule for Internal domain\")\r\n| extend ClientIPAddress = case(ClientIP has \".\", tostring(split(ClientIP, \":\")[0]), ClientIP has \"[\", tostring(trim_start(@'[[]', tostring(split(ClientIP, \"]\")[0]))), ClientIP)\r\n| extend Port = case(\r\n ClientIP has \".\", (split(ClientIP, \":\")[1]),\r\n ClientIP has \"[\", tostring(split(ClientIP, \"]:\")[1]),\r\n ClientIP\r\n )\r\n| project TimeGenerated, UserId, UserDomain, subDomain, Operation, ForwardedtoDomain, ClientIPAddress, Result, Port, OriginatingServer, OfficeObjectId, fwdingDestination\r\n| extend timestamp = TimeGenerated, AccountCustomEntity = UserId, IPCustomEntity = ClientIPAddress, HostCustomEntity = OriginatingServer\r\n| summarize count() by UserId, Operation", "size": 0, "showAnalytics": true, "title": "Watchlist: Office Mail Forwarding", "noDataMessage": "No Results Confirm Watchlists are Configured", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "redBright", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "coldHot" } } ] }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "Results42", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MicrosoftPurviewInformationProtection\r\n| lookup kind=inner _GetWatchlist('{Watchlist}')\r\non $left.UserId == $right.SearchKey\r\n| extend CommonProperties = parse_json(Common) \r\n| extend ApplicationName = tostring(CommonProperties.ApplicationName) \r\n| summarize count() by UserId, LabelName, Operation, ApplicationName\r\n| sort by count_ desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Watchlist: Sensitive Data Access", "noDataMessage": "No Results Confirm Watchlists are Configured", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId_s_s", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "AADEmail", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "warning", "text": "{0}{1}" } ] } }, { "columnMatch": "QueryText", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "yellow", "text": "{0}{1}" } ] } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "Results43", "styleSettings": { "maxWidth": "50" } } ] }, "conditionalVisibility": { "parameterName": "isWatchlistsVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Watchlist Group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Microsoft Purview Insider Risk Management Cases](https://compliance.microsoft.com/insiderriskmgmt?viewid=cases)\n---\n\nCases are the heart of insider risk management and allow you to deeply investigate and act on issues generated by risk indicators defined in your policies. Cases are manually created from alerts in situations where further action is needed to address a compliance-related issue for a user. Each case is scoped to a single user and multiple alerts for the user can be added to an existing case or to a new case. After investigating the details of a case, you can take action by:\n\n • Sending the user a notice\n • Resolving the case as benign\n • Sharing the case with your ServiceNow instance or with an email recipient\n • Escalating the case for an Advanced eDiscovery investigation \nFor more information, see ✳️[Insider Risk Management Cases](https://docs.microsoft.com/microsoft-365/compliance/insider-risk-management-cases) & ✳️[Insider Risk Management Investigation and Escalation Video](https://www.youtube.com/watch?v=UONUSmkRC8s)" }, "customWidth": "40", "name": "Case Overview" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 4" }, { "type": 1, "content": { "json": "## 💡[Case Dashboard](https://compliance.microsoft.com/insiderriskmgmt?viewid=cases)\r\n![Image Name](https://docs.microsoft.com/microsoft-365/media/insider-risk-cases-dashboard.png)\r\n\r\n" }, "customWidth": "45", "name": "text - 179", "styleSettings": { "maxWidth": "45" } }, { "type": 1, "content": { "json": "## 💡[User Activity](https://docs.microsoft.com/microsoft-365/compliance/insider-risk-management-cases#user-activity)\r\n![Image Name](https://docs.microsoft.com/microsoft-365/media/insider-risk-user-activities.png)\r\n\r\n\r\n" }, "customWidth": "40", "name": "text - 179 - Copy" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 5" }, { "type": 1, "content": { "json": "## 💡[Insider Risk Management Content Explorer](https://docs.microsoft.com/microsoft-365/compliance/insider-risk-management-content-explorer)\r\n![Image Name](https://docs.microsoft.com/microsoft-365/media/insider-risk-content-explorer.png)\r\n\r\n\r\n" }, "customWidth": "45", "name": "text - 6", "styleSettings": { "maxWidth": "45" } } ] }, "conditionalVisibility": { "parameterName": "isIRMVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Insider Risk Management CAse" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "d8e8ac75-e764-4ff8-941b-bc8ad77df072", "version": "KqlParameterItem/1.0", "name": "Results316", "type": 1, "query": "SigninLogs\r\n| where UserPrincipalName in ({UserPrincipalName}) \r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "100", "name": "Results316", "styleSettings": { "maxWidth": "100" } }, { "type": 1, "content": { "json": "# [Entity Search](https://docs.microsoft.com/azure/sentinel/get-visibility)\n---\n\nThis section provides a summary of available entity logging by data tables. This provides situational awareness of where entity logging is available and patterns of this data over time. This data is summarized by both count and an area chart over time. Use \"Entity Selector\" above to focus investigation by UserPrincipalName. \n\n\n\n" }, "customWidth": "40", "name": "text - 2", "styleSettings": { "maxWidth": "40" } }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 4" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "60106e49-64fe-43dc-9f83-a20b316e43c2", "linkTarget": "OpenBlade", "linkLabel": "Entity Behavior", "style": "secondary", "bladeOpenContext": { "bladeName": "EntitySearchBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [] } } ] }, "customWidth": "15", "name": "EL0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union withsource = Table_Name *\r\n| where column_ifexists('AADEmail', '') in ({UserPrincipalName})\r\nor column_ifexists('Account', '') in ({UserPrincipalName})\r\nor column_ifexists('AccountName', '') in ({UserPrincipalName})\r\nor column_ifexists('AccountUpn', '') in ({UserPrincipalName})\r\nor column_ifexists('AccountUPN', '') in ({UserPrincipalName})\r\nor column_ifexists('Caller', '') in ({UserPrincipalName})\r\nor column_ifexists('CompromisedEntity', '') in ({UserPrincipalName})\r\nor column_ifexists('DestinationUserID', '') in ({UserPrincipalName})\r\nor column_ifexists('DestinationUserName', '') in ({UserPrincipalName})\r\nor column_ifexists('DisplayName', '') in ({UserPrincipalName})\r\nor column_ifexists('Email_s', '') in ({UserPrincipalName})\r\nor column_ifexists('FullyQualifiedSubjectUserName', '') in ({UserPrincipalName})\r\nor column_ifexists('InitiatingProcessAccountUpn', '') in ({UserPrincipalName}) \r\nor column_ifexists('MailboxOwnerUPN', '') in ({UserPrincipalName})\r\nor column_ifexists('Owner', '') in ({UserPrincipalName})\r\nor column_ifexists('RecipientEmailAddress', '') in ({UserPrincipalName})\r\nor column_ifexists('RequesterUpn', '') in ({UserPrincipalName})\r\nor column_ifexists('SenderMailFromAddress', '') in ({UserPrincipalName})\r\nor column_ifexists('SourceIdentity', '') in ({UserPrincipalName})\r\nor column_ifexists('SourceUserID', '') in ({UserPrincipalName})\r\nor column_ifexists('SourceUserName', '') in ({UserPrincipalName})\r\nor column_ifexists('SubjectUserName', '') in ({UserPrincipalName})\r\nor column_ifexists('TargetUser', '') in ({UserPrincipalName})\r\nor column_ifexists('TargetUserName', '') in ({UserPrincipalName})\r\nor column_ifexists('Upn', '') in ({UserPrincipalName})\r\nor column_ifexists('User_s', '') in ({UserPrincipalName})\r\nor column_ifexists('UserId', '') in ({UserPrincipalName}) \r\nor column_ifexists('UserId_', '') in ({UserPrincipalName})\r\nor column_ifexists('UserId_s_s', '') in ({UserPrincipalName}) \r\nor column_ifexists('userName', '') in ({UserPrincipalName})\r\nor column_ifexists('UserName', '') in ({UserPrincipalName}) \r\nor column_ifexists('UserName_s', '') in ({UserPrincipalName})\r\nor column_ifexists('userPrincipalName_s', '') in ({UserPrincipalName})\r\nor column_ifexists('UserPrincipalName_s', '') in ({UserPrincipalName})\r\nor column_ifexists('UserPrincipalName', '') in ({UserPrincipalName})\r\n| summarize count() by Table_Name\r\n| project-rename ['Data Table']=Table_Name, ['Logs Count']=count_\r\n| sort by ['Logs Count'] desc\r\n\r\n\r\n\r\n\r\n ", "size": 0, "showAnalytics": true, "title": "Entity Logs Summary", "color": "blue", "noDataMessage": "No Entity Logs Available During This TimeRange", "timeContextFromParameter": "TimeRange", "timeBrushParameterName": "tbMthlyUsage", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Data Table", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Log", "text": "{0}{1}" } ] } }, { "columnMatch": "Logs Count", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "Log_Tables", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "Logs_Count", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Other", "color": "green" } ], "xSettings": {}, "ySettings": {} }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "40", "conditionalVisibility": { "parameterName": "Results316", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results316" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union withsource = Table_Name *\r\n| where column_ifexists('AADEmail', '') in ({UserPrincipalName})\r\nor column_ifexists('Account', '') in ({UserPrincipalName})\r\nor column_ifexists('AccountName', '') in ({UserPrincipalName})\r\nor column_ifexists('AccountUpn', '') in ({UserPrincipalName})\r\nor column_ifexists('AccountUPN', '') in ({UserPrincipalName})\r\nor column_ifexists('Caller', '') in ({UserPrincipalName})\r\nor column_ifexists('CompromisedEntity', '') in ({UserPrincipalName})\r\nor column_ifexists('DestinationUserID', '') in ({UserPrincipalName})\r\nor column_ifexists('DestinationUserName', '') in ({UserPrincipalName})\r\nor column_ifexists('DisplayName', '') in ({UserPrincipalName})\r\nor column_ifexists('Email_s', '') in ({UserPrincipalName})\r\nor column_ifexists('FullyQualifiedSubjectUserName', '') in ({UserPrincipalName})\r\nor column_ifexists('InitiatingProcessAccountUpn', '') in ({UserPrincipalName}) \r\nor column_ifexists('MailboxOwnerUPN', '') in ({UserPrincipalName})\r\nor column_ifexists('Owner', '') in ({UserPrincipalName})\r\nor column_ifexists('RecipientEmailAddress', '') in ({UserPrincipalName})\r\nor column_ifexists('RequesterUpn', '') in ({UserPrincipalName})\r\nor column_ifexists('SenderMailFromAddress', '') in ({UserPrincipalName})\r\nor column_ifexists('SourceIdentity', '') in ({UserPrincipalName})\r\nor column_ifexists('SourceUserID', '') in ({UserPrincipalName})\r\nor column_ifexists('SourceUserName', '') in ({UserPrincipalName})\r\nor column_ifexists('SubjectUserName', '') in ({UserPrincipalName})\r\nor column_ifexists('TargetUser', '') in ({UserPrincipalName})\r\nor column_ifexists('TargetUserName', '') in ({UserPrincipalName})\r\nor column_ifexists('Upn', '') in ({UserPrincipalName})\r\nor column_ifexists('User_s', '') in ({UserPrincipalName})\r\nor column_ifexists('UserId', '') in ({UserPrincipalName}) \r\nor column_ifexists('UserId_', '') in ({UserPrincipalName})\r\nor column_ifexists('UserId_s_s', '') in ({UserPrincipalName}) \r\nor column_ifexists('userName', '') in ({UserPrincipalName})\r\nor column_ifexists('UserName', '') in ({UserPrincipalName}) \r\nor column_ifexists('UserName_s', '') in ({UserPrincipalName})\r\nor column_ifexists('userPrincipalName_s', '') in ({UserPrincipalName})\r\nor column_ifexists('UserPrincipalName_s', '') in ({UserPrincipalName})\r\nor column_ifexists('UserPrincipalName', '') in ({UserPrincipalName})\r\n| project-rename Log_Tables=Table_Name\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by Log_Tables\r\n| render areachart\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Entity Logs over Time", "noDataMessage": "No Entity Logs Available During This TimeRange", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Logs_Count", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results316", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results316b" } ] }, "conditionalVisibility": { "parameterName": "isEntitySearchVisible", "comparison": "isEqualTo", "value": "true" }, "name": "User Logs" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "7afa304d-b448-4d6c-8c54-69e51a7249a9", "version": "KqlParameterItem/1.0", "name": "Results113", "type": 1, "query": "SecurityIncident\r\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n | where Status == \"New\" or Status == \"Active\"\r\n | mv-expand AlertIds\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind= innerunique ( \r\n SecurityAlert \r\n )\r\n on $left.AlertId == $right.SystemAlertId\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n| extend Href_ = tostring(parse_json(ExtendedLinks)[0].Href)\r\n| where UPN <> \"\"\r\n| project UPN, AlertName, Severity, ProductName, Tactics, Sid, Href_, TimeGenerated\r\n| where UPN in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Results113", "styleSettings": { "maxWidth": "33" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "9b6b6d2b-a6d9-46c6-882d-722c0c9d455f", "version": "KqlParameterItem/1.0", "name": "Results114", "type": 1, "query": "SecurityIncident\r\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n | mv-expand AlertIds\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind= innerunique ( \r\n SecurityAlert \r\n )\r\n on $left.AlertId == $right.SystemAlertId\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n| extend Href_ = tostring(parse_json(ExtendedLinks)[0].Href)\r\n| where UPN <> \"\"\r\n| where UPN in ({UserPrincipalName})\r\n| distinct UPN, AlertName, Severity, ProductName, AlertLink, TimeGenerated\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Results114" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "61bbb62e-3324-4484-ad32-511868f2acdb", "version": "KqlParameterItem/1.0", "name": "Results153", "type": 1, "query": "SecurityIncident\r\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n | where Status == \"New\" or Status == \"Active\"\r\n | mv-expand AlertIds\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind= innerunique ( \r\n SecurityAlert \r\n )\r\n on $left.AlertId == $right.SystemAlertId\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n| extend Href_ = tostring(parse_json(ExtendedLinks)[0].Href)\r\n| where UPN <> \"\"\r\n| where UPN in ({UserPrincipalName})\r\n| extend Workspace = tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Data Sources\"]))[0])\r\n| extend IncidentURL = strcat(\"https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident/subscriptions/\",WorkspaceSubscriptionId,\"/resourceGroups/\",WorkspaceResourceGroup,\"/providers/Microsoft.OperationalInsights/workspaces/\",Workspace,\"/providers/Microsoft.SecurityInsights/Incidents/\",IncidentName)\r\n| where IncidentURL !contains \"//resourceGroups\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Results153" }, { "type": 1, "content": { "json": "# [Security Alerts](https://docs.microsoft.com/azure/sentinel/create-incidents-from-alerts)\n---\n\nAlerts triggered in Microsoft security solutions that are connected to Microsoft Sentinel, such as Microsoft Cloud App Security and Microsoft Defender for Identity (formerly Azure ATP), do not automatically create incidents in Microsoft Sentinel. By default, when you connect a Microsoft solution to Microsoft Sentinel, any alert generated in that service will be stored as raw data in Microsoft Sentinel, in the Security Alert table in your Microsoft Sentinel workspace. You can then use that data like any other raw data you connect into Microsoft Sentinel. You can easily configure Microsoft Sentinel to automatically create incidents every time an alert is triggered in a connected Microsoft security solution.\n\n\n\n" }, "customWidth": "40", "name": "text - 2" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 15" }, { "type": 1, "content": { "json": "| Security Alert Queries | | |\r\n|:--| - | - |\r\n| Security Alerts over Time| Security Alerts by MITRE ATT&CK® Tactics | MITRE ATT&CK® Tactics Proportions |\r\n| MITRE ATT&CK® Tactics over Time | Security Alerts Count by Detecting Product Name | Security Alerts: Go-To > |\r\n| Security Incidents: Go to >| Detected Techniques | \r\n\r\nThis section is bound by the above parameters for Subscription, Workspace, TimeRange, and User. Panels are dynamically displayed meaning numerous queries are executed and only panels returning data are displayed. \r\n" }, "customWidth": "40", "name": "SI OV" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "0bb302f6-3711-459c-ba1b-5ae434c35ca2", "linkTarget": "OpenBlade", "linkLabel": "MITRE ATT&CK", "style": "secondary", "bladeOpenContext": { "bladeName": "MitrePage.ReactView", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [] } }, { "id": "7b5c2d76-fdec-4352-b9cb-4dba91fd1743", "linkTarget": "OpenBlade", "linkLabel": "Analytics", "style": "secondary", "bladeOpenContext": { "bladeName": "AlertRulesV2Blade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [] } }, { "id": "9c126a78-d59c-4d36-bf83-44390f586db0", "linkTarget": "OpenBlade", "linkLabel": "Hunting", "style": "secondary", "bladeOpenContext": { "bladeName": "HuntingBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [] } } ] }, "customWidth": "50", "name": "EL0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n | mv-expand AlertIds\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind= innerunique ( \r\n SecurityAlert \r\n )\r\n on $left.AlertId == $right.SystemAlertId\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n| extend Href_ = tostring(parse_json(ExtendedLinks)[0].Href)\r\n| where UPN <> \"\"\r\n| project UPN, AlertName, Severity, ProductName, Tactics, Sid, Href_, TimeGenerated\r\n| where UPN in ({UserPrincipalName})\r\n| project UPN, AlertName, Severity, ProductName, TimeGenerated\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by AlertName\r\n| render timechart\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Security Alerts by Time", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "conditionalVisibility": { "parameterName": "Results113", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results113" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n | mv-expand AlertIds\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind= innerunique ( \r\n SecurityAlert \r\n )\r\n on $left.AlertId == $right.SystemAlertId\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n| extend Href_ = tostring(parse_json(ExtendedLinks)[0].Href)\r\n| where UPN <> \"\"\r\n| project UPN, AlertName, Severity, ProductName, Tactics, Sid, Href_, TimeGenerated\r\n| where UPN in ({UserPrincipalName})\r\n| summarize count() by Tactics\r\n| sort by count_ desc\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Security Alerts by MITRE ATT&CK® Tactics", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "Tactics", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "yellowOrangeRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results113", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results113b", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n | mv-expand AlertIds\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind= innerunique ( \r\n SecurityAlert \r\n )\r\n on $left.AlertId == $right.SystemAlertId\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n| extend Href_ = tostring(parse_json(ExtendedLinks)[0].Href)\r\n| where UPN <> \"\"\r\n| project UPN, AlertName, Severity, ProductName, Tactics, Sid, Href_, TimeGenerated\r\n| where UPN in ({UserPrincipalName})\r\n| summarize count() by Tactics\r\n| render piechart\r\n\r\n", "size": 0, "showAnalytics": true, "title": "MITRE ATT&CK® Tactics Proportions", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ] }, "tileSettings": { "titleContent": { "columnMatch": "Tactics", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "yellowOrangeRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results113", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results113c", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n | where Status == \"New\" or Status == \"Active\"\r\n | mv-expand AlertIds\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind= innerunique ( \r\n SecurityAlert \r\n )\r\n on $left.AlertId == $right.SystemAlertId\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n| extend Href_ = tostring(parse_json(ExtendedLinks)[0].Href)\r\n| where UPN <> \"\"\r\n| project UPN, AlertName, Severity, ProductName, Tactics, Sid, Href_, TimeGenerated\r\n| where UPN in ({UserPrincipalName})\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by Tactics\r\n| render timechart\r\n\r\n", "size": 0, "showAnalytics": true, "title": "MITRE ATT&CK® Tactics over Time", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ] }, "tileSettings": { "titleContent": { "columnMatch": "Tactics", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "yellowOrangeRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results113", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results113d", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n | where Status == \"New\" or Status == \"Active\"\r\n | mv-expand AlertIds\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind= innerunique ( \r\n SecurityAlert \r\n )\r\n on $left.AlertId == $right.SystemAlertId\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n| extend Href_ = tostring(parse_json(ExtendedLinks)[0].Href)\r\n| where UPN <> \"\"\r\n| project UPN, AlertName, Severity, ProductName, Tactics, Sid, Href_, TimeGenerated\r\n| where UPN in ({UserPrincipalName})\r\n| summarize count() by ProductName\r\n", "size": 0, "showAnalytics": true, "title": "Security Alerts Count by Detecting Product Name", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "ProductName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_heatmap_count__1", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_heatmap_count__1", "sortOrder": 2 } ], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results113", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results113e", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n | mv-expand AlertIds\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind= innerunique ( \r\n SecurityAlert \r\n )\r\n on $left.AlertId == $right.SystemAlertId\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n| extend Href_ = tostring(parse_json(ExtendedLinks)[0].Href)\r\n| where UPN <> \"\"\r\n| where UPN in ({UserPrincipalName})\r\n| extend UserPrincipalName=UPN\r\n| distinct UserPrincipalName, AlertName, Severity, AlertLink, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "Security Alerts", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Alert", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "Sev0", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "Sev1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "Sev2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Sev3", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Alert >" } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "conditionalVisibility": { "parameterName": "Results113", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results113f" } ] }, "conditionalVisibility": { "parameterName": "isSecurityAlertsVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Security Alerts Group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "7afa304d-b448-4d6c-8c54-69e51a7249a9", "version": "KqlParameterItem/1.0", "name": "Results113", "type": 1, "query": "SecurityIncident\r\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n | where Status == \"New\" or Status == \"Active\"\r\n | mv-expand AlertIds\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind= innerunique ( \r\n SecurityAlert \r\n )\r\n on $left.AlertId == $right.SystemAlertId\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n| extend Href_ = tostring(parse_json(ExtendedLinks)[0].Href)\r\n| where UPN <> \"\"\r\n| project UPN, AlertName, Severity, ProductName, Tactics, Sid, Href_, TimeGenerated\r\n| where UPN in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "Results113", "styleSettings": { "maxWidth": "50" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "9b6b6d2b-a6d9-46c6-882d-722c0c9d455f", "version": "KqlParameterItem/1.0", "name": "Results114", "type": 1, "query": "SecurityIncident\r\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n | mv-expand AlertIds\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind= innerunique ( \r\n SecurityAlert \r\n )\r\n on $left.AlertId == $right.SystemAlertId\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n| extend Href_ = tostring(parse_json(ExtendedLinks)[0].Href)\r\n| where UPN <> \"\"\r\n| where UPN in ({UserPrincipalName})\r\n| distinct UPN, AlertName, Severity, ProductName, AlertLink, TimeGenerated\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "5", "name": "Results114", "styleSettings": { "maxWidth": "5" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "61bbb62e-3324-4484-ad32-511868f2acdb", "version": "KqlParameterItem/1.0", "name": "Results153", "type": 1, "query": "SecurityIncident\r\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n | where Status == \"New\" or Status == \"Active\"\r\n | mv-expand AlertIds\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind= innerunique ( \r\n SecurityAlert \r\n )\r\n on $left.AlertId == $right.SystemAlertId\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n| extend Href_ = tostring(parse_json(ExtendedLinks)[0].Href)\r\n| where UPN <> \"\"\r\n| where UPN in ({UserPrincipalName})\r\n| extend Workspace = tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Data Sources\"]))[0])\r\n| extend IncidentURL = strcat(\"https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident/subscriptions/\",WorkspaceSubscriptionId,\"/resourceGroups/\",WorkspaceResourceGroup,\"/providers/Microsoft.OperationalInsights/workspaces/\",Workspace,\"/providers/Microsoft.SecurityInsights/Incidents/\",IncidentName)\r\n| where IncidentURL !contains \"//resourceGroups\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "15", "name": "Results153", "styleSettings": { "maxWidth": "15" } }, { "type": 1, "content": { "json": "# [Security Incidents](https://docs.microsoft.com/azure/sentinel/investigate-cases)\n---\n\nAn incident can include multiple alerts. It's an aggregation of all the relevant evidence for a specific investigation. An incident is created based on analytics rules that you created in the Analytics page. The properties related to the alerts, such as severity and status, are set at the incident level. After you let Microsoft Sentinel know what kinds of threats you're looking for and how to find them, you can monitor detected threats by investigating incidents.\n\n" }, "customWidth": "40", "name": "text - 2" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 8" }, { "type": 1, "content": { "json": "| Security Alert Queries | | |\r\n|:--| - | - |\r\n| Security Incidents | Security Incidents Count |Security Incidents over Time |\r\n\r\nThis section is bound by the above parameters for Subscription, Workspace, TimeRange, and User. Panels are dynamically displayed meaning numerous queries are executed and only panels returning data are displayed. \r\n" }, "customWidth": "40", "name": "SI OV" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n | mv-expand AlertIds\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind= innerunique ( \r\n SecurityAlert \r\n )\r\n on $left.AlertId == $right.SystemAlertId\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n| extend Href_ = tostring(parse_json(ExtendedLinks)[0].Href)\r\n| where UPN <> \"\"\r\n| where UPN in ({UserPrincipalName})\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| extend UserPrincipalName=UPN\r\n| parse IncidentUrl with * '/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| distinct UserPrincipalName, Title, Severity, IncidentBlade, IncidentNumber, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "Security Incidents", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "Title", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Alert", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "Sev0", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "Sev1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "Sev2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Sev3", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentBlade", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "Incident >>", "bladeOpenContext": { "bladeName": "CaseBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "id", "source": "column", "value": "IncidentBlade" } ] } } }, { "columnMatch": "UPN", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "ProductName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } } ], "filter": true, "sortBy": [ { "itemKey": "IncidentNumber", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "IncidentNumber", "sortOrder": 2 } ], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "conditionalVisibility": { "parameterName": "Results153", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results153" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n | mv-expand AlertIds\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind= innerunique ( \r\n SecurityAlert \r\n )\r\n on $left.AlertId == $right.SystemAlertId\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n| extend Href_ = tostring(parse_json(ExtendedLinks)[0].Href)\r\n| where UPN <> \"\"\r\n| project UPN, AlertName, Severity, ProductName, Tactics, Sid, Href_, TimeGenerated\r\n| where UPN in ({UserPrincipalName})\r\n| summarize count() by UPN\r\n| render piechart\r\n", "size": 0, "showAnalytics": true, "title": "Security Incidents Count", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UPN", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "3", "text": "{0}{1}" } ] } }, { "columnMatch": "ProductName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results113", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results113h", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n | mv-expand AlertIds\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind= innerunique ( \r\n SecurityAlert \r\n )\r\n on $left.AlertId == $right.SystemAlertId\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n| extend Href_ = tostring(parse_json(ExtendedLinks)[0].Href)\r\n| where UPN <> \"\"\r\n| where UPN in ({UserPrincipalName})\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by Title\r\n| render timechart\r\n\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Security Incidents over Time", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ] }, "tileSettings": { "titleContent": { "columnMatch": "UserPrincipalName", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "redBright" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results114", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results114e", "styleSettings": { "maxWidth": "50" } } ] }, "conditionalVisibility": { "parameterName": "isSecurityIncidentsVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Security Incidents Group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "7afa304d-b448-4d6c-8c54-69e51a7249a9", "version": "KqlParameterItem/1.0", "name": "Results115", "type": 1, "query": "let AnomalousSigninActivity = BehaviorAnalytics\r\n | where ActionType == \"Sign-in\"\r\n | where (UsersInsights.NewAccount == True or UsersInsights.DormantAccount == True) and (\r\n ActivityInsights.FirstTimeUserAccessedResource == True and ActivityInsights.ResourceUncommonlyAccessedAmongPeers == True\r\n or ActivityInsights.FirstTimeUserUsedApp == True and ActivityInsights.AppUncommonlyUsedAmongPeers == False)\r\n | join (\r\n SigninLogs | where Status.errorCode == 0 or Status.errorCode == 0 and RiskDetail != \"none\"\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Successful Logon\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Valid Accounts\",\r\n SubTechnique = \"\",\r\n Description = \"Successful Sign-in with one or more of the following indications: sign by new or recently dormant accounts and sign in with resource for the first time (while none of their peers did) or to an app for the first time (while none of their peers did) or performed by a user with Risk indication from AAD\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet critical = dynamic(['9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3', 'c4e39bd9-1100-46d3-8c65-fb160da0071f', '158c047a-c907-4556-b7ef-446551a6b5f7', '62e90394-69f5-4237-9190-012177145e10', 'd29b2b05-8046-44ba-8758-1e26182fcf32', '729827e3-9c14-49f7-bb1b-9608f156bbb8', '966707d0-3269-4727-9be2-8c3a10f19b9d', '194ae4cb-b126-40b2-bd5b-6091b380977d', 'fe930be7-5e62-47db-91af-98c3a49a38b1']);\r\nlet high = dynamic(['cf1c38e5-3621-4004-a7cb-879624dced7c', '7495fdc4-34c4-4d15-a289-98788ce399fd', 'aaf43236-0c0d-4d5f-883a-6955382ac081', '3edaf663-341e-4475-9f94-5c398ef6c070', '7698a772-787b-4ac8-901f-60d6b08affd2', 'b1be1c3e-b65d-4f19-8427-f6fa0d97feb9', '9f06204d-73c1-4d4c-880a-6edb90606fd8', '29232cdf-9323-42fd-ade2-1d097af3e4de', 'be2f45a1-457d-42af-a067-6ec1fa63bc45', '7be44c8a-adaf-4e2a-84d6-ab2649e08a13', 'e8611ab8-c189-46e8-94e1-60213ab1f814']);//insider\r\nlet AnomalousRoleAssignment = AuditLogs\r\n | where TimeGenerated > ago(28d)\r\n | where OperationName == \"Add member to role\"\r\n | mv-expand TargetResources\r\n | extend RoleId = tostring(TargetResources.modifiedProperties[0].newValue)\r\n | where isnotempty(RoleId) and RoleId in (critical, high)\r\n | extend RoleName = tostring(TargetResources.modifiedProperties[1].newValue)\r\n | where isnotempty(RoleName)\r\n | extend TargetId = tostring(TargetResources.id)\r\n | extend Target = tostring(TargetResources.userPrincipalName)\r\n | join kind=inner (\r\n BehaviorAnalytics\r\n | where ActionType == \"Add member to role\"\r\n | where UsersInsights.BlasrRadius == \"High\" or ActivityInsights.FirstTimeUserPerformedAction == true\r\n )\r\n on $left._ItemId == $right.SourceRecordId\r\n | extend AnomalyName = \"Anomalous Role Assignment\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Account Manipulation\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may manipulate accounts to maintain access to victim systems. These actions include adding new accounts to high privileged groups. Dragonfly 2.0, for example, added newly created accounts to the administrators group to maintain elevated access. The query below generates an output of all high Blast Radius users performing Add member to privileged role, or ones that add users for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, RoleName, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; let LogOns=materialize(\r\n BehaviorAnalytics\r\n | where ActivityType == \"LogOn\");\r\nlet AnomalousResourceAccess = LogOns\r\n | where ActionType == \"ResourceAccess\"\r\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\r\n | extend AnomalyName = \"Anomalous Resource Access\",\r\n Tactic = \"Lateral Movement\",\r\n Technique = \"\",\r\n SubTechnique = \"\",\r\n Description = \"Adversary may be trying to move through the environment. APT29 and APT32, for example, has used PtH & PtT techniques to lateral move around the network. The query below generates an output of all users performing an resource access (4624:3) to devices for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousRDPActivity = LogOns\r\n | where ActionType == \"RemoteInteractiveLogon\"\r\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\r\n | extend AnomalyName = \"Anomalous RDP Activity\",\r\n Tactic = \"Lateral Movement\",\r\n Technique = \"\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. FIN10, for example, has used RDP to move laterally to systems in the victim environment. The query below generates an output of all users performing a remote interactive logon (4624:10) to a device for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousLogintoDevices = LogOns\r\n | where ActionType == \"InteractiveLogon\"\r\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\r\n | where UsersInsights.DormantAccount == true or DevicesInsights.LocalAdmin == true\r\n | extend AnomalyName = \"Anomalous Login To Devices\",\r\n Tactic = \"Privilege Escalation\",\r\n Technique = \"Valid Accounts\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may steal the credentials of a specific user or service account using Credential Access techniques or capture credentials earlier in their reconnaissance process through social engineering for means of gaining Initial Access. APT33, for example, has used valid accounts for initial access and privilege escalation. The query below generates an output of all administrator users performing an interactive logon (4624:2) to a device for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousPasswordReset = BehaviorAnalytics\r\n | where ActionType == \"Reset user password\"\r\n | where ActivityInsights.FirstTimeUserPerformedAction == \"True\"\r\n | join (\r\n AuditLogs\r\n | where OperationName == \"Reset user password\"\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | mv-expand TargetResources\r\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(TargetResources.userPrincipalName, \"#\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Password Reset\",\r\n Tactic = \"Impact\",\r\n Technique = \"Account Access Removal\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts. LockerGoga, for example, has been observed changing account passwords and logging off current users. The query below generates an output of all users performing Reset user password for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority\r\n | sort by TimeGenerated desc;\r\nlet AnomalousGeoLocationLogon = BehaviorAnalytics\r\n | where ActionType == \"Sign-in\"\r\n | where ActivityInsights.FirstTimeUserConnectedFromCountry == True and (ActivityInsights.FirstTimeConnectionFromCountryObservedInTenant == True or ActivityInsights.CountryUncommonlyConnectedFromAmongPeers == True)\r\n | join (\r\n SigninLogs\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Successful Logon\",\r\n Tactic = \"Initial Access\",\r\n Technique = \"Valid Accounts\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may steal the credentials of a specific user or service account using Credential Access techniques or capture credentials earlier in their reconnaissance process through social engineering for means of gaining Initial Access. APT33, for example, has used valid accounts for initial access. The query below generates an output of successful Sign-in performed by a user from a new geo location he has never connected from before, and none of his peers as well.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousFailedLogon = BehaviorAnalytics\r\n | where ActivityType == \"LogOn\"\r\n | where UsersInsights.BlastRadius == \"High\"\r\n | join (\r\n SigninLogs \r\n | where Status.errorCode == 50126\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Failed Logon\",\r\n Tactic = \"Credential Access\",\r\n Technique = \"Brute Force\",\r\n SubTechnique = \"Password Guessing\",\r\n Description = \"Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Emotet, for example, has been observed using a hard coded list of passwords to brute force user accounts. The query below generates an output of all users with 'High' BlastRadius that perform failed Sign-in:Invalid username or password.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousAADAccountManipulation = AuditLogs\r\n | where OperationName == \"Update user\"\r\n | mv-expand AdditionalDetails\r\n | where AdditionalDetails.key == \"UserPrincipalName\"\r\n | mv-expand TargetResources\r\n | extend RoleId = tostring(TargetResources.modifiedProperties[0].newValue)\r\n | where isnotempty(RoleId) and RoleId in (critical, high)\r\n | extend RoleName = tostring(TargetResources.modifiedProperties[1].newValue)\r\n | where isnotempty(RoleName)\r\n | extend TargetId = tostring(TargetResources.id)\r\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(TargetResources.userPrincipalName, \"#\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\r\n | join kind=inner ( \r\n BehaviorAnalytics\r\n | where ActionType == \"Update user\"\r\n | where UsersInsights.BlasrRadius == \"High\" or ActivityInsights.FirstTimeUserPerformedAction == true\r\n )\r\n on $left._ItemId == $right.SourceRecordId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName) \r\n | extend AnomalyName = \"Anomalous Account Manipulation\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Account Manipulation\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may manipulate accounts to maintain access to victim systems. These actions include adding new accounts to high privileged groups. Dragonfly 2.0, for example, added newly created accounts to the administrators group to maintain elevated access. The query below generates an output of all high Blast Radius users performing 'Update user' (name change) to privileged role, or ones that changed users for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, RoleName, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; let AnomalousAADAccountCreation = BehaviorAnalytics\r\n | where ActionType == \"Add user\"\r\n | where ActivityInsights.FirstTimeUserPerformedAction == True or ActivityInsights.FirstTimeActionPerformedInTenant == True or ActivityInsights.ActionUncommonlyPerformedAmongPeers == true\r\n | join(\r\n AuditLogs\r\n | where OperationName == \"Add user\"\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | mv-expand TargetResources\r\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(TargetResources.userPrincipalName, \"#\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\r\n | extend DisplayName = tostring(UsersInsights.AccountDisplayName),\r\n UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Account Creation\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Create Account\",\r\n SubTechnique = \"Cloud Account\",\r\n Description = \"Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system. The query below generates an output of all the users performing user creation for the first time and the target users that were created.\"\t\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority\r\n | sort by TimeGenerated desc;\r\nlet AnomalyTable = union kind=outer AnomalousSigninActivity, AnomalousRoleAssignment, AnomalousResourceAccess, AnomalousRDPActivity, AnomalousPasswordReset, AnomalousLogintoDevices, AnomalousGeoLocationLogon, AnomalousAADAccountManipulation, AnomalousAADAccountCreation, AnomalousFailedLogon;\r\nlet TopUsersByAnomalies = AnomalyTable\r\n | summarize hint.strategy = shuffle AnomalyCount=count() by UserName, UserPrincipalName, tostring(UsersInsights.OnPremSid), tostring(UsersInsights.AccountObjectId)\r\n | project Name=tolower(UserName), UPN=tolower(UserPrincipalName), AadUserId=UsersInsights_AccountObjectId, Sid=UsersInsights_OnPremSid, AnomalyCount\r\n | sort by AnomalyCount desc;\r\nlet TopUsersByIncidents = SecurityIncident\r\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n | where Status == \"New\" or Status == \"Active\"\r\n | mv-expand AlertIds\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind= innerunique ( \r\n SecurityAlert \r\n )\r\n on $left.AlertId == $right.SystemAlertId\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n | union TopUsersByAnomalies\r\n | extend \r\n AadPivot = iff(isempty(AadUserId), iff(isempty(Sid), Name, Sid), AadUserId),\r\n SidPivot = iff(isempty(Sid), iff(isempty(AadUserId), Name, AadUserId), Sid),\r\n UPNExists = iff(isempty(UPN), false, true),\r\n NameExists = iff(isempty(Name), false, true),\r\n SidExists = iff(isempty(Sid), false, true),\r\n AADExists = iff(isempty(AadUserId), false, true)\r\n | summarize hint.strategy = shuffle IncidentCount=dcount(IncidentNumber, 4), AlertCount=dcountif(AlertId, isnotempty(AlertId), 4), AnomalyCount=sum(AnomalyCount), any(Title, Severity, Status, StartTime, IncidentNumber, IncidentUrl, Owner), UPNAnchor=anyif(UPN, UPNExists == true), NameAnchor=anyif(Name, NameExists == true), AadAnchor=anyif(AadUserId, AADExists == true), SidAnchor=anyif(Sid, SidExists == true), any(SidPivot) by AadPivot\r\n | summarize hint.strategy = shuffle IncidentCount=sum(IncidentCount), AlertCount=sum(AlertCount), AnomalyCount=sum(AnomalyCount), UPNAnchor=anyif(UPNAnchor, isempty(UPNAnchor) == false), NameAnchor=anyif(NameAnchor, isempty(NameAnchor) == false), AadAnchor=anyif(AadAnchor, isempty(AadAnchor) == false), SidAnchor=anyif(SidAnchor, isempty(SidAnchor) == false), any(any_Title, any_Severity, any_StartTime, any_IncidentNumber, any_IncidentUrl) by any_SidPivot\r\n | summarize hint.strategy = shuffle IncidentCount=sum(IncidentCount), AlertCount=sum(AlertCount), AnomalyCount=sum(AnomalyCount), UPNAnchor=anyif(UPNAnchor, isempty(UPNAnchor) == false), AadAnchor=anyif(AadAnchor, isempty(AadAnchor) == false), SidAnchor=anyif(SidAnchor, isempty(SidAnchor) == false), any(any_any_Title, any_any_Severity, any_any_StartTime, any_any_IncidentNumber, any_any_IncidentUrl) by NameAnchor\r\n | project [\"UserName\"]=NameAnchor, IncidentCount, AlertCount, AnomalyCount, [\"AadUserId\"]=AadAnchor, [\"OnPremSid\"]=SidAnchor, [\"UserPrincipalName\"]=UPNAnchor;\r\nTopUsersByIncidents\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results115", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "3b2e768e-33c5-4c1c-8d35-5b2860f4da7a", "version": "KqlParameterItem/1.0", "name": "Results116", "type": 1, "query": "BehaviorAnalytics\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| extend ActionUncommonlyPerformedByUser_ = tostring(ActivityInsights.ActionUncommonlyPerformedByUser)\r\n| extend FirstTimeUserConnectedViaISP_ = tostring(ActivityInsights.FirstTimeUserConnectedViaISP)\r\n| extend ISPUncommonlyUsedAmongPeers_ = tostring(ActivityInsights.ISPUncommonlyUsedAmongPeers)\r\n| extend UncommonHighVolumeOfActions_ = tostring(ActivityInsights.UncommonHighVolumeOfActions)\r\n| extend BlastRadius_ = tostring(UsersInsights.BlastRadius)\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results116", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "63acc8db-7bde-4aae-a356-9527f705d65e", "version": "KqlParameterItem/1.0", "name": "Results117", "type": 1, "query": "BehaviorAnalytics\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| where SourceIPAddress <> \"\"\r\n| extend ISP_ = tostring(DevicesInsights.ISP)\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results117", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "9b1b3553-c10a-408f-bf54-d953a5d3eb08", "version": "KqlParameterItem/1.0", "name": "Results118", "type": 1, "query": "BehaviorAnalytics\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| where SourceIPAddress <> \"\"\r\n| extend ISP_ = tostring(DevicesInsights.ISP)\r\n| where ISP_ <> \"\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results118", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "9f5d5a26-49c4-4b61-8197-fa7debba49d3", "version": "KqlParameterItem/1.0", "name": "Results119", "type": 1, "query": "BehaviorAnalytics\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| where SourceIPAddress <> \"\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results119", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "53afa8cf-2073-4d04-a435-2331f2518fa0", "version": "KqlParameterItem/1.0", "name": "Results125", "type": 1, "query": "BehaviorAnalytics\r\n| where ActionType == \"Reset user password\"\r\n| where ActivityInsights has \"True\"\r\n| join (\r\n AuditLogs\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n| mv-expand TargetResources\r\n| extend Target = iff(tostring(TargetResources.userPrincipalName) has \"#EXT#\", replace(\"_\", \"@\", tostring(split(TargetResources.userPrincipalName, \"#\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\r\n| extend UserPrincipalName = iff(UserPrincipalName has \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName has \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results125", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "6ca8f834-b246-4d7e-9b6d-1b1551e8b04f", "version": "KqlParameterItem/1.0", "name": "Results126", "type": 1, "query": "BehaviorAnalytics\r\n| where ActivityType == \"LogOn\"\r\n| where UsersInsights.BlastRadius == \"High\"\r\n| join (\r\nSigninLogs | where Status.errorCode == 50126\r\n) on $left.SourceRecordId == $right._ItemId\r\n| extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\",replace(\"_\",\"@\",tostring(split(UserPrincipalName, \"#\")[0])),UserPrincipalName),\r\nUserName = iff(UserName contains \"#EXT#\",replace(\"_\",\"@\",tostring(split(UserPrincipalName, \"#\")[0])),UserName)\r\n| project TimeGenerated, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType,[\"Evidence\"]=ActivityInsights, ResourceDisplayName,AppDisplayName ,SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results126", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "ce41b4e0-2d91-4819-b593-7075fe13356a", "version": "KqlParameterItem/1.0", "name": "Results127", "type": 1, "query": "BehaviorAnalytics\r\n| where ActionType == \"Sign-in\"\r\n| where ActivityInsights.FirstTimeConnectionFromCountryObservedInTenant == True and ActivityInsights.CountryUncommonlyConnectedFromAmongPeers == True\r\n | join (\r\nSigninLogs\r\n) on $left.SourceRecordId == $right._ItemId\r\n| extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\",replace(\"_\",\"@\",tostring(split(UserPrincipalName, \"#\")[0])),UserPrincipalName),\r\nUserName = iff(UserName contains \"#EXT#\",replace(\"_\",\"@\",tostring(split(UserPrincipalName, \"#\")[0])),UserName)\r\n| project TimeGenerated, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType,[\"Evidence\"]=ActivityInsights, ResourceDisplayName,AppDisplayName ,SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results127", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "a9b97462-f182-41b8-af27-3012ddd39e7e", "version": "KqlParameterItem/1.0", "name": "Results128", "type": 1, "query": "//Critical Roles: can impersonate any user or app, can update passwords for users or service principals (if the role can let a user update passwords for privileged users, if an attacker compromises this user then attacker can update passwords for privileged users hence gaining more privileges so users with this role are equally critical)\r\n//High Roles: Administrators that can manage all aspects or permissions of important products but can't update credentials and impersonate another user/app\r\nlet critical = dynamic(['9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3','c4e39bd9-1100-46d3-8c65-fb160da0071f','158c047a-c907-4556-b7ef-446551a6b5f7','62e90394-69f5-4237-9190-012177145e10','d29b2b05-8046-44ba-8758-1e26182fcf32','729827e3-9c14-49f7-bb1b-9608f156bbb8','966707d0-3269-4727-9be2-8c3a10f19b9d','194ae4cb-b126-40b2-bd5b-6091b380977d','fe930be7-5e62-47db-91af-98c3a49a38b1']);\r\nlet high = dynamic(['cf1c38e5-3621-4004-a7cb-879624dced7c','7495fdc4-34c4-4d15-a289-98788ce399fd','aaf43236-0c0d-4d5f-883a-6955382ac081','3edaf663-341e-4475-9f94-5c398ef6c070','7698a772-787b-4ac8-901f-60d6b08affd2','b1be1c3e-b65d-4f19-8427-f6fa0d97feb9','9f06204d-73c1-4d4c-880a-6edb90606fd8','29232cdf-9323-42fd-ade2-1d097af3e4de','be2f45a1-457d-42af-a067-6ec1fa63bc45','7be44c8a-adaf-4e2a-84d6-ab2649e08a13','e8611ab8-c189-46e8-94e1-60213ab1f814']);\r\nAuditLogs\r\n| where OperationName == \"Update user\"\r\n| mv-expand AdditionalDetails\r\n| mv-expand TargetResources\r\n| where AdditionalDetails.key == \"UserPrincipalName\"\r\n| mv-expand TargetResources\r\n| extend RoleId = tostring(TargetResources.modifiedProperties[0].newValue)\r\n| extend RoleName = tostring(TargetResources.modifiedProperties[1].newValue)\r\n| where RoleId in (critical,high)\r\n| where isnotempty(RoleId) or isnotempty(RoleName)\r\n| extend TargetId = tostring(TargetResources.id)\r\n| extend Target = iff(tostring(TargetResources.userPrincipalName) has \"#EXT#\",replace(\"_\",\"@\",tostring(split(TargetResources.userPrincipalName, \"#\")[0])),TargetResources.userPrincipalName),tostring(TargetResources.userPrincipalName)\r\n| join kind=inner ( BehaviorAnalytics\r\n) on $left._ItemId == $right.SourceRecordId\r\n| where UsersInsights.BlastRadius == \"High\" or ActivityInsights has \"True\"\r\n| extend UserPrincipalName = iff(UserPrincipalName has \"#EXT#\",replace(\"_\",\"@\",tostring(split(UserPrincipalName, \"#\")[0])),UserPrincipalName),\r\nUserName = iff(UserName has \"#EXT#\",replace(\"_\",\"@\",tostring(split(UserPrincipalName, \"#\")[0])),UserName) \r\n| project TimeGenerated, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target,RoleName,ActivityInsights ,SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results128", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "03aec6b5-05a4-4225-a3a8-a52d6f792b71", "version": "KqlParameterItem/1.0", "name": "Results129", "type": 1, "query": "//Critical Roles: can impersonate any user or app, can update passwords for users or service principals (if the role can let a user update passwords for privileged users, if an attacker compromises this user then attacker can update passwords for privileged users hence gaining more privileges so users with this role are equally critical)\r\n//High Roles: Administrators that can manage all aspects or permissions of important products but can't update credentials and impersonate another user/app\r\nlet critical = dynamic(['9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3','c4e39bd9-1100-46d3-8c65-fb160da0071f','158c047a-c907-4556-b7ef-446551a6b5f7','62e90394-69f5-4237-9190-012177145e10','d29b2b05-8046-44ba-8758-1e26182fcf32','729827e3-9c14-49f7-bb1b-9608f156bbb8','966707d0-3269-4727-9be2-8c3a10f19b9d','194ae4cb-b126-40b2-bd5b-6091b380977d','fe930be7-5e62-47db-91af-98c3a49a38b1']);\r\nlet high = dynamic(['cf1c38e5-3621-4004-a7cb-879624dced7c','7495fdc4-34c4-4d15-a289-98788ce399fd','aaf43236-0c0d-4d5f-883a-6955382ac081','3edaf663-341e-4475-9f94-5c398ef6c070','7698a772-787b-4ac8-901f-60d6b08affd2','b1be1c3e-b65d-4f19-8427-f6fa0d97feb9','9f06204d-73c1-4d4c-880a-6edb90606fd8','29232cdf-9323-42fd-ade2-1d097af3e4de','be2f45a1-457d-42af-a067-6ec1fa63bc45','7be44c8a-adaf-4e2a-84d6-ab2649e08a13','e8611ab8-c189-46e8-94e1-60213ab1f814']);\r\nAuditLogs\r\n| where OperationName == \"Update user\"\r\n| mv-expand AdditionalDetails\r\n| mv-expand TargetResources\r\n| where AdditionalDetails.key == \"UserPrincipalName\"\r\n| mv-expand TargetResources\r\n| extend RoleId = tostring(TargetResources.modifiedProperties[0].newValue)\r\n| extend RoleName = tostring(TargetResources.modifiedProperties[1].newValue)\r\n| where RoleId in (critical,high)\r\n| where isnotempty(RoleId) or isnotempty(RoleName)\r\n| extend TargetId = tostring(TargetResources.id)\r\n| extend Target = iff(tostring(TargetResources.userPrincipalName) has \"#EXT#\",replace(\"_\",\"@\",tostring(split(TargetResources.userPrincipalName, \"#\")[0])),TargetResources.userPrincipalName),tostring(TargetResources.userPrincipalName)\r\n| join kind=inner ( BehaviorAnalytics\r\n) on $left._ItemId == $right.SourceRecordId\r\n| where UsersInsights.BlastRadius == \"High\" or ActivityInsights has \"True\"\r\n| extend UserPrincipalName = iff(UserPrincipalName has \"#EXT#\",replace(\"_\",\"@\",tostring(split(UserPrincipalName, \"#\")[0])),UserPrincipalName),\r\nUserName = iff(UserName has \"#EXT#\",replace(\"_\",\"@\",tostring(split(UserPrincipalName, \"#\")[0])),UserName) \r\n| project TimeGenerated, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target,RoleName,ActivityInsights ,SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results129", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "0b730519-a486-4d2b-825e-694e0053724e", "version": "KqlParameterItem/1.0", "name": "Results130", "type": 1, "query": "let critical = dynamic(['9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3','c4e39bd9-1100-46d3-8c65-fb160da0071f','158c047a-c907-4556-b7ef-446551a6b5f7','62e90394-69f5-4237-9190-012177145e10','d29b2b05-8046-44ba-8758-1e26182fcf32','729827e3-9c14-49f7-bb1b-9608f156bbb8','966707d0-3269-4727-9be2-8c3a10f19b9d','194ae4cb-b126-40b2-bd5b-6091b380977d','fe930be7-5e62-47db-91af-98c3a49a38b1']);\r\nlet high = dynamic(['cf1c38e5-3621-4004-a7cb-879624dced7c','7495fdc4-34c4-4d15-a289-98788ce399fd','aaf43236-0c0d-4d5f-883a-6955382ac081','3edaf663-341e-4475-9f94-5c398ef6c070','7698a772-787b-4ac8-901f-60d6b08affd2','b1be1c3e-b65d-4f19-8427-f6fa0d97feb9','9f06204d-73c1-4d4c-880a-6edb90606fd8','29232cdf-9323-42fd-ade2-1d097af3e4de','be2f45a1-457d-42af-a067-6ec1fa63bc45','7be44c8a-adaf-4e2a-84d6-ab2649e08a13','e8611ab8-c189-46e8-94e1-60213ab1f814']);\r\nAuditLogs\r\n| where OperationName == \"Add member to role\"\r\n| mv-expand TargetResources\r\n| extend RoleId = tostring(TargetResources.modifiedProperties[0].newValue)\r\n| extend RoleName = tostring(TargetResources.modifiedProperties[1].newValue)\r\n| where RoleId in (critical,high)\r\n| extend TargetId = tostring(TargetResources.id)\r\n| extend Target = tostring(TargetResources.userPrincipalName)\r\n| where isnotempty(RoleId) or isnotempty(RoleName)\r\n| join kind=inner ( BehaviorAnalytics\r\n) on $left._ItemId == $right.SourceRecordId\r\n| where UsersInsights.BlasrRadius == \"High\" or ActivityInsights has \"True\"\r\n| project TimeGenerated, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target,RoleName,ActivityInsights ,SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "40", "name": "Results130", "styleSettings": { "maxWidth": "40" } }, { "type": 1, "content": { "json": "# [Behavior Logs](https://docs.microsoft.com/azure/sentinel/identify-threats-with-entity-behavior-analytics)\n---\n\nIdentifying threats inside your organization and their potential impact - whether a compromised entity or a malicious insider - has always been a time-consuming and labor-intensive process. Sifting through alerts, connecting the dots, and active hunting all add up to massive amounts of time and effort expended with minimal returns, and the possibility of sophisticated threats simply evading discovery. Particularly elusive threats like zero-day, targeted, and advanced persistent threats can be the most dangerous to your organization, making their detection all the more critical.\n\n\n\n" }, "customWidth": "40", "name": "text - 2" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 22" }, { "type": 1, "content": { "json": "| Behavior Queries | | |\r\n|:--| :--|\r\n| User Entity Behavior Analytics Alerts | Account Blast Radius | IP Address Summary |\r\n| Internet Service Providers Summary | Addresses by Location | Anomalous Sign-in Activity |\r\n| Actions Uncommonly Performed By User | First Time User Connected Via ISP | Uncommon ISP | \r\n| Uncommonly High Volume Of Actions | Anomalous Password Reset | Anomalous Failed Logon |\r\n| Anomalous Geo Location Logon | Anomalous Account Manipulation | Anomalous Account Creation | \r\n| Anomalous Role Assignment | - | - |\r\n\r\nThis section is bound by the above parameters for Subscription, Workspace, TimeRange, and User. Panels are dynamically displayed meaning numerous queries are executed and only panels returning data are displayed. " }, "customWidth": "40", "name": "SI OV" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let AnomalousSigninActivity = BehaviorAnalytics\r\n | where ActionType == \"Sign-in\"\r\n | where (UsersInsights.NewAccount == True or UsersInsights.DormantAccount == True) and (\r\n ActivityInsights.FirstTimeUserAccessedResource == True and ActivityInsights.ResourceUncommonlyAccessedAmongPeers == True\r\n or ActivityInsights.FirstTimeUserUsedApp == True and ActivityInsights.AppUncommonlyUsedAmongPeers == False)\r\n | join (\r\n SigninLogs | where Status.errorCode == 0 or Status.errorCode == 0 and RiskDetail != \"none\"\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Successful Logon\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Valid Accounts\",\r\n SubTechnique = \"\",\r\n Description = \"Successful Sign-in with one or more of the following indications: sign by new or recently dormant accounts and sign in with resource for the first time (while none of their peers did) or to an app for the first time (while none of their peers did) or performed by a user with Risk indication from AAD\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet critical = dynamic(['9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3', 'c4e39bd9-1100-46d3-8c65-fb160da0071f', '158c047a-c907-4556-b7ef-446551a6b5f7', '62e90394-69f5-4237-9190-012177145e10', 'd29b2b05-8046-44ba-8758-1e26182fcf32', '729827e3-9c14-49f7-bb1b-9608f156bbb8', '966707d0-3269-4727-9be2-8c3a10f19b9d', '194ae4cb-b126-40b2-bd5b-6091b380977d', 'fe930be7-5e62-47db-91af-98c3a49a38b1']);\r\nlet high = dynamic(['cf1c38e5-3621-4004-a7cb-879624dced7c', '7495fdc4-34c4-4d15-a289-98788ce399fd', 'aaf43236-0c0d-4d5f-883a-6955382ac081', '3edaf663-341e-4475-9f94-5c398ef6c070', '7698a772-787b-4ac8-901f-60d6b08affd2', 'b1be1c3e-b65d-4f19-8427-f6fa0d97feb9', '9f06204d-73c1-4d4c-880a-6edb90606fd8', '29232cdf-9323-42fd-ade2-1d097af3e4de', 'be2f45a1-457d-42af-a067-6ec1fa63bc45', '7be44c8a-adaf-4e2a-84d6-ab2649e08a13', 'e8611ab8-c189-46e8-94e1-60213ab1f814']);//insider\r\nlet AnomalousRoleAssignment = AuditLogs\r\n | where TimeGenerated > ago(28d)\r\n | where OperationName == \"Add member to role\"\r\n | mv-expand TargetResources\r\n | extend RoleId = tostring(TargetResources.modifiedProperties[0].newValue)\r\n | where isnotempty(RoleId) and RoleId in (critical, high)\r\n | extend RoleName = tostring(TargetResources.modifiedProperties[1].newValue)\r\n | where isnotempty(RoleName)\r\n | extend TargetId = tostring(TargetResources.id)\r\n | extend Target = tostring(TargetResources.userPrincipalName)\r\n | join kind=inner (\r\n BehaviorAnalytics\r\n | where ActionType == \"Add member to role\"\r\n | where UsersInsights.BlasrRadius == \"High\" or ActivityInsights.FirstTimeUserPerformedAction == true\r\n )\r\n on $left._ItemId == $right.SourceRecordId\r\n | extend AnomalyName = \"Anomalous Role Assignment\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Account Manipulation\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may manipulate accounts to maintain access to victim systems. These actions include adding new accounts to high privileged groups. Dragonfly 2.0, for example, added newly created accounts to the administrators group to maintain elevated access. The query below generates an output of all high Blast Radius users performing Add member to privileged role, or ones that add users for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, RoleName, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; let LogOns=materialize(\r\n BehaviorAnalytics\r\n | where ActivityType == \"LogOn\");\r\nlet AnomalousResourceAccess = LogOns\r\n | where ActionType == \"ResourceAccess\"\r\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\r\n | extend AnomalyName = \"Anomalous Resource Access\",\r\n Tactic = \"Lateral Movement\",\r\n Technique = \"\",\r\n SubTechnique = \"\",\r\n Description = \"Adversary may be trying to move through the environment. APT29 and APT32, for example, has used PtH & PtT techniques to lateral move around the network. The query below generates an output of all users performing an resource access (4624:3) to devices for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousRDPActivity = LogOns\r\n | where ActionType == \"RemoteInteractiveLogon\"\r\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\r\n | extend AnomalyName = \"Anomalous RDP Activity\",\r\n Tactic = \"Lateral Movement\",\r\n Technique = \"\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. FIN10, for example, has used RDP to move laterally to systems in the victim environment. The query below generates an output of all users performing a remote interactive logon (4624:10) to a device for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousLogintoDevices = LogOns\r\n | where ActionType == \"InteractiveLogon\"\r\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\r\n | where UsersInsights.DormantAccount == true or DevicesInsights.LocalAdmin == true\r\n | extend AnomalyName = \"Anomalous Login To Devices\",\r\n Tactic = \"Privilege Escalation\",\r\n Technique = \"Valid Accounts\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may steal the credentials of a specific user or service account using Credential Access techniques or capture credentials earlier in their reconnaissance process through social engineering for means of gaining Initial Access. APT33, for example, has used valid accounts for initial access and privilege escalation. The query below generates an output of all administrator users performing an interactive logon (4624:2) to a device for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousPasswordReset = BehaviorAnalytics\r\n | where ActionType == \"Reset user password\"\r\n | where ActivityInsights.FirstTimeUserPerformedAction == \"True\"\r\n | join (\r\n AuditLogs\r\n | where OperationName == \"Reset user password\"\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | mv-expand TargetResources\r\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(TargetResources.userPrincipalName, \"#\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Password Reset\",\r\n Tactic = \"Impact\",\r\n Technique = \"Account Access Removal\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts. LockerGoga, for example, has been observed changing account passwords and logging off current users. The query below generates an output of all users performing Reset user password for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority\r\n | sort by TimeGenerated desc;\r\nlet AnomalousGeoLocationLogon = BehaviorAnalytics\r\n | where ActionType == \"Sign-in\"\r\n | where ActivityInsights.FirstTimeUserConnectedFromCountry == True and (ActivityInsights.FirstTimeConnectionFromCountryObservedInTenant == True or ActivityInsights.CountryUncommonlyConnectedFromAmongPeers == True)\r\n | join (\r\n SigninLogs\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Successful Logon\",\r\n Tactic = \"Initial Access\",\r\n Technique = \"Valid Accounts\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may steal the credentials of a specific user or service account using Credential Access techniques or capture credentials earlier in their reconnaissance process through social engineering for means of gaining Initial Access. APT33, for example, has used valid accounts for initial access. The query below generates an output of successful Sign-in performed by a user from a new geo location he has never connected from before, and none of his peers as well.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousFailedLogon = BehaviorAnalytics\r\n | where ActivityType == \"LogOn\"\r\n | where UsersInsights.BlastRadius == \"High\"\r\n | join (\r\n SigninLogs \r\n | where Status.errorCode == 50126\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Failed Logon\",\r\n Tactic = \"Credential Access\",\r\n Technique = \"Brute Force\",\r\n SubTechnique = \"Password Guessing\",\r\n Description = \"Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Emotet, for example, has been observed using a hard coded list of passwords to brute force user accounts. The query below generates an output of all users with 'High' BlastRadius that perform failed Sign-in:Invalid username or password.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousAADAccountManipulation = AuditLogs\r\n | where OperationName == \"Update user\"\r\n | mv-expand AdditionalDetails\r\n | where AdditionalDetails.key == \"UserPrincipalName\"\r\n | mv-expand TargetResources\r\n | extend RoleId = tostring(TargetResources.modifiedProperties[0].newValue)\r\n | where isnotempty(RoleId) and RoleId in (critical, high)\r\n | extend RoleName = tostring(TargetResources.modifiedProperties[1].newValue)\r\n | where isnotempty(RoleName)\r\n | extend TargetId = tostring(TargetResources.id)\r\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(TargetResources.userPrincipalName, \"#\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\r\n | join kind=inner ( \r\n BehaviorAnalytics\r\n | where ActionType == \"Update user\"\r\n | where UsersInsights.BlasrRadius == \"High\" or ActivityInsights.FirstTimeUserPerformedAction == true\r\n )\r\n on $left._ItemId == $right.SourceRecordId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName) \r\n | extend AnomalyName = \"Anomalous Account Manipulation\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Account Manipulation\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may manipulate accounts to maintain access to victim systems. These actions include adding new accounts to high privileged groups. Dragonfly 2.0, for example, added newly created accounts to the administrators group to maintain elevated access. The query below generates an output of all high Blast Radius users performing 'Update user' (name change) to privileged role, or ones that changed users for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, RoleName, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; let AnomalousAADAccountCreation = BehaviorAnalytics\r\n | where ActionType == \"Add user\"\r\n | where ActivityInsights.FirstTimeUserPerformedAction == True or ActivityInsights.FirstTimeActionPerformedInTenant == True or ActivityInsights.ActionUncommonlyPerformedAmongPeers == true\r\n | join(\r\n AuditLogs\r\n | where OperationName == \"Add user\"\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | mv-expand TargetResources\r\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(TargetResources.userPrincipalName, \"#\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\r\n | extend DisplayName = tostring(UsersInsights.AccountDisplayName),\r\n UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Account Creation\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Create Account\",\r\n SubTechnique = \"Cloud Account\",\r\n Description = \"Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system. The query below generates an output of all the users performing user creation for the first time and the target users that were created.\"\t\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority\r\n | sort by TimeGenerated desc;\r\nlet AnomalyTable = union kind=outer AnomalousSigninActivity, AnomalousRoleAssignment, AnomalousResourceAccess, AnomalousRDPActivity, AnomalousPasswordReset, AnomalousLogintoDevices, AnomalousGeoLocationLogon, AnomalousAADAccountManipulation, AnomalousAADAccountCreation, AnomalousFailedLogon;\r\nlet TopUsersByAnomalies = AnomalyTable\r\n | summarize hint.strategy = shuffle AnomalyCount=count() by UserName, UserPrincipalName, tostring(UsersInsights.OnPremSid), tostring(UsersInsights.AccountObjectId)\r\n | project Name=tolower(UserName), UPN=tolower(UserPrincipalName), AadUserId=UsersInsights_AccountObjectId, Sid=UsersInsights_OnPremSid, AnomalyCount\r\n | sort by AnomalyCount desc;\r\nlet TopUsersByIncidents = SecurityIncident\r\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n | where Status == \"New\" or Status == \"Active\"\r\n | mv-expand AlertIds\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind= innerunique ( \r\n SecurityAlert \r\n )\r\n on $left.AlertId == $right.SystemAlertId\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n | union TopUsersByAnomalies\r\n | extend \r\n AadPivot = iff(isempty(AadUserId), iff(isempty(Sid), Name, Sid), AadUserId),\r\n SidPivot = iff(isempty(Sid), iff(isempty(AadUserId), Name, AadUserId), Sid),\r\n UPNExists = iff(isempty(UPN), false, true),\r\n NameExists = iff(isempty(Name), false, true),\r\n SidExists = iff(isempty(Sid), false, true),\r\n AADExists = iff(isempty(AadUserId), false, true)\r\n | summarize hint.strategy = shuffle IncidentCount=dcount(IncidentNumber, 4), AlertCount=dcountif(AlertId, isnotempty(AlertId), 4), AnomalyCount=sum(AnomalyCount), any(Title, Severity, Status, StartTime, IncidentNumber, IncidentUrl, Owner), UPNAnchor=anyif(UPN, UPNExists == true), NameAnchor=anyif(Name, NameExists == true), AadAnchor=anyif(AadUserId, AADExists == true), SidAnchor=anyif(Sid, SidExists == true), any(SidPivot) by AadPivot\r\n | summarize hint.strategy = shuffle IncidentCount=sum(IncidentCount), AlertCount=sum(AlertCount), AnomalyCount=sum(AnomalyCount), UPNAnchor=anyif(UPNAnchor, isempty(UPNAnchor) == false), NameAnchor=anyif(NameAnchor, isempty(NameAnchor) == false), AadAnchor=anyif(AadAnchor, isempty(AadAnchor) == false), SidAnchor=anyif(SidAnchor, isempty(SidAnchor) == false), any(any_Title, any_Severity, any_StartTime, any_IncidentNumber, any_IncidentUrl) by any_SidPivot\r\n | summarize hint.strategy = shuffle IncidentCount=sum(IncidentCount), AlertCount=sum(AlertCount), AnomalyCount=sum(AnomalyCount), UPNAnchor=anyif(UPNAnchor, isempty(UPNAnchor) == false), AadAnchor=anyif(AadAnchor, isempty(AadAnchor) == false), SidAnchor=anyif(SidAnchor, isempty(SidAnchor) == false), any(any_any_Title, any_any_Severity, any_any_StartTime, any_any_IncidentNumber, any_any_IncidentUrl) by NameAnchor\r\n | project [\"UserName\"]=NameAnchor, IncidentCount, AlertCount, AnomalyCount, [\"AadUserId\"]=AadAnchor, [\"OnPremSid\"]=SidAnchor, [\"UserPrincipalName\"]=UPNAnchor;\r\nTopUsersByIncidents\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| project UserPrincipalName, IncidentCount, AlertCount, AnomalyCount\r\n| sort by IncidentCount desc\r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "User Entity Behavior Analytics Alerts", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentCount", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "AlertCount", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "AnomalyCount", "formatter": 8, "formatOptions": { "palette": "yellow" } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_heatmap_IncidentCount_1", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_heatmap_IncidentCount_1", "sortOrder": 2 } ] }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results115", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results115", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BehaviorAnalytics\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| extend ActionUncommonlyPerformedByUser_ = tostring(ActivityInsights.ActionUncommonlyPerformedByUser)\r\n| extend FirstTimeUserConnectedViaISP_ = tostring(ActivityInsights.FirstTimeUserConnectedViaISP)\r\n| extend ISPUncommonlyUsedAmongPeers_ = tostring(ActivityInsights.ISPUncommonlyUsedAmongPeers)\r\n| extend UncommonHighVolumeOfActions_ = tostring(ActivityInsights.UncommonHighVolumeOfActions)\r\n| extend BlastRadius_ = tostring(UsersInsights.BlastRadius)\r\n| summarize count() by UserPrincipalName, BlastRadius_\r\n| project UserPrincipalName, BlastRadius_\r\n| sort by BlastRadius_ desc\r\n| limit 250\r\n\r\n\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Account Blast Radius", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "BlastRadius_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "blue", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_thresholds_BlastRadius__1", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_thresholds_BlastRadius__1", "sortOrder": 2 } ], "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results116", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results116", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BehaviorAnalytics\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| where SourceIPAddress <> \"\"\r\n| extend ISP_ = tostring(DevicesInsights.ISP)\r\n| summarize count() by UserPrincipalName, SourceIPAddress, ISP_, SourceIPLocation, EventSource\r\n| sort by count_ desc\r\n| limit 250\r\n\r\n", "size": 0, "showAnalytics": true, "title": "IP Address Summary", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "IPAddress", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ], "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "conditionalVisibility": { "parameterName": "Results117", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results117" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BehaviorAnalytics\r\n| where ActionType == \"Reset user password\"\r\n| where ActivityInsights has \"True\"\r\n| join (\r\n AuditLogs\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n| mv-expand TargetResources\r\n| extend Target = iff(tostring(TargetResources.userPrincipalName) has \"#EXT#\", replace(\"_\", \"@\", tostring(split(TargetResources.userPrincipalName, \"#\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\r\n| extend UserPrincipalName = iff(UserPrincipalName has \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName has \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| summarize count() by UserPrincipalName\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Anomalous Password Reset", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "IPAddress", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } } ], "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results125", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results125", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BehaviorAnalytics\r\n| where ActivityType == \"LogOn\"\r\n| where UsersInsights.BlastRadius == \"High\"\r\n| join (\r\nSigninLogs | where Status.errorCode == 50126\r\n) on $left.SourceRecordId == $right._ItemId\r\n| extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\",replace(\"_\",\"@\",tostring(split(UserPrincipalName, \"#\")[0])),UserPrincipalName),\r\nUserName = iff(UserName contains \"#EXT#\",replace(\"_\",\"@\",tostring(split(UserPrincipalName, \"#\")[0])),UserName)\r\n| project TimeGenerated, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType,[\"Evidence\"]=ActivityInsights, ResourceDisplayName,AppDisplayName ,SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| summarize count() by UserPrincipalName\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Anomalous Failed Logon", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "IPAddress", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ] }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results126", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results126", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "BehaviorAnalytics\r\n| where ActionType == \"Sign-in\"\r\n| where ActivityInsights.FirstTimeConnectionFromCountryObservedInTenant == True and ActivityInsights.CountryUncommonlyConnectedFromAmongPeers == True\r\n | join (\r\nSigninLogs\r\n) on $left.SourceRecordId == $right._ItemId\r\n| extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\",replace(\"_\",\"@\",tostring(split(UserPrincipalName, \"#\")[0])),UserPrincipalName),\r\nUserName = iff(UserName contains \"#EXT#\",replace(\"_\",\"@\",tostring(split(UserPrincipalName, \"#\")[0])),UserName)\r\n| project TimeGenerated, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType,[\"Evidence\"]=ActivityInsights, ResourceDisplayName,AppDisplayName ,SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| summarize count() by UserPrincipalName\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Anomalous Geolocation Logon", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "IPAddress", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ] }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results127", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results127", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Critical Roles: can impersonate any user or app, can update passwords for users or service principals (if the role can let a user update passwords for privileged users, if an attacker compromises this user then attacker can update passwords for privileged users hence gaining more privileges so users with this role are equally critical)\r\n//High Roles: Administrators that can manage all aspects or permissions of important products but can't update credentials and impersonate another user/app\r\nlet critical = dynamic(['9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3','c4e39bd9-1100-46d3-8c65-fb160da0071f','158c047a-c907-4556-b7ef-446551a6b5f7','62e90394-69f5-4237-9190-012177145e10','d29b2b05-8046-44ba-8758-1e26182fcf32','729827e3-9c14-49f7-bb1b-9608f156bbb8','966707d0-3269-4727-9be2-8c3a10f19b9d','194ae4cb-b126-40b2-bd5b-6091b380977d','fe930be7-5e62-47db-91af-98c3a49a38b1']);\r\nlet high = dynamic(['cf1c38e5-3621-4004-a7cb-879624dced7c','7495fdc4-34c4-4d15-a289-98788ce399fd','aaf43236-0c0d-4d5f-883a-6955382ac081','3edaf663-341e-4475-9f94-5c398ef6c070','7698a772-787b-4ac8-901f-60d6b08affd2','b1be1c3e-b65d-4f19-8427-f6fa0d97feb9','9f06204d-73c1-4d4c-880a-6edb90606fd8','29232cdf-9323-42fd-ade2-1d097af3e4de','be2f45a1-457d-42af-a067-6ec1fa63bc45','7be44c8a-adaf-4e2a-84d6-ab2649e08a13','e8611ab8-c189-46e8-94e1-60213ab1f814']);\r\nAuditLogs\r\n| where OperationName == \"Update user\"\r\n| mv-expand AdditionalDetails\r\n| mv-expand TargetResources\r\n| where AdditionalDetails.key == \"UserPrincipalName\"\r\n| mv-expand TargetResources\r\n| extend RoleId = tostring(TargetResources.modifiedProperties[0].newValue)\r\n| extend RoleName = tostring(TargetResources.modifiedProperties[1].newValue)\r\n| where RoleId in (critical,high)\r\n| where isnotempty(RoleId) or isnotempty(RoleName)\r\n| extend TargetId = tostring(TargetResources.id)\r\n| extend Target = iff(tostring(TargetResources.userPrincipalName) has \"#EXT#\",replace(\"_\",\"@\",tostring(split(TargetResources.userPrincipalName, \"#\")[0])),TargetResources.userPrincipalName),tostring(TargetResources.userPrincipalName)\r\n| join kind=inner ( BehaviorAnalytics\r\n) on $left._ItemId == $right.SourceRecordId\r\n| where UsersInsights.BlastRadius == \"High\" or ActivityInsights has \"True\"\r\n| extend UserPrincipalName = iff(UserPrincipalName has \"#EXT#\",replace(\"_\",\"@\",tostring(split(UserPrincipalName, \"#\")[0])),UserPrincipalName),\r\nUserName = iff(UserName has \"#EXT#\",replace(\"_\",\"@\",tostring(split(UserPrincipalName, \"#\")[0])),UserName) \r\n| project TimeGenerated, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target,RoleName,ActivityInsights ,SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| summarize count() by UserPrincipalName\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Anomalous AAD Account Manipulation", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "IPAddress", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ] }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results128", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results128", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Critical Roles: can impersonate any user or app, can update passwords for users or service principals (if the role can let a user update passwords for privileged users, if an attacker compromises this user then attacker can update passwords for privileged users hence gaining more privileges so users with this role are equally critical)\r\n//High Roles: Administrators that can manage all aspects or permissions of important products but can't update credentials and impersonate another user/app\r\nlet critical = dynamic(['9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3','c4e39bd9-1100-46d3-8c65-fb160da0071f','158c047a-c907-4556-b7ef-446551a6b5f7','62e90394-69f5-4237-9190-012177145e10','d29b2b05-8046-44ba-8758-1e26182fcf32','729827e3-9c14-49f7-bb1b-9608f156bbb8','966707d0-3269-4727-9be2-8c3a10f19b9d','194ae4cb-b126-40b2-bd5b-6091b380977d','fe930be7-5e62-47db-91af-98c3a49a38b1']);\r\nlet high = dynamic(['cf1c38e5-3621-4004-a7cb-879624dced7c','7495fdc4-34c4-4d15-a289-98788ce399fd','aaf43236-0c0d-4d5f-883a-6955382ac081','3edaf663-341e-4475-9f94-5c398ef6c070','7698a772-787b-4ac8-901f-60d6b08affd2','b1be1c3e-b65d-4f19-8427-f6fa0d97feb9','9f06204d-73c1-4d4c-880a-6edb90606fd8','29232cdf-9323-42fd-ade2-1d097af3e4de','be2f45a1-457d-42af-a067-6ec1fa63bc45','7be44c8a-adaf-4e2a-84d6-ab2649e08a13','e8611ab8-c189-46e8-94e1-60213ab1f814']);\r\nAuditLogs\r\n| where OperationName == \"Update user\"\r\n| mv-expand AdditionalDetails\r\n| mv-expand TargetResources\r\n| where AdditionalDetails.key == \"UserPrincipalName\"\r\n| mv-expand TargetResources\r\n| extend RoleId = tostring(TargetResources.modifiedProperties[0].newValue)\r\n| extend RoleName = tostring(TargetResources.modifiedProperties[1].newValue)\r\n| where RoleId in (critical,high)\r\n| where isnotempty(RoleId) or isnotempty(RoleName)\r\n| extend TargetId = tostring(TargetResources.id)\r\n| extend Target = iff(tostring(TargetResources.userPrincipalName) has \"#EXT#\",replace(\"_\",\"@\",tostring(split(TargetResources.userPrincipalName, \"#\")[0])),TargetResources.userPrincipalName),tostring(TargetResources.userPrincipalName)\r\n| join kind=inner ( BehaviorAnalytics\r\n) on $left._ItemId == $right.SourceRecordId\r\n| where UsersInsights.BlastRadius == \"High\" or ActivityInsights has \"True\"\r\n| extend UserPrincipalName = iff(UserPrincipalName has \"#EXT#\",replace(\"_\",\"@\",tostring(split(UserPrincipalName, \"#\")[0])),UserPrincipalName),\r\nUserName = iff(UserName has \"#EXT#\",replace(\"_\",\"@\",tostring(split(UserPrincipalName, \"#\")[0])),UserName) \r\n| project TimeGenerated, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target,RoleName,ActivityInsights ,SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| summarize count() by UserPrincipalName\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Anomalous Account Creation", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "IPAddress", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ] }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results129", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results129", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let critical = dynamic(['9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3','c4e39bd9-1100-46d3-8c65-fb160da0071f','158c047a-c907-4556-b7ef-446551a6b5f7','62e90394-69f5-4237-9190-012177145e10','d29b2b05-8046-44ba-8758-1e26182fcf32','729827e3-9c14-49f7-bb1b-9608f156bbb8','966707d0-3269-4727-9be2-8c3a10f19b9d','194ae4cb-b126-40b2-bd5b-6091b380977d','fe930be7-5e62-47db-91af-98c3a49a38b1']);\r\nlet high = dynamic(['cf1c38e5-3621-4004-a7cb-879624dced7c','7495fdc4-34c4-4d15-a289-98788ce399fd','aaf43236-0c0d-4d5f-883a-6955382ac081','3edaf663-341e-4475-9f94-5c398ef6c070','7698a772-787b-4ac8-901f-60d6b08affd2','b1be1c3e-b65d-4f19-8427-f6fa0d97feb9','9f06204d-73c1-4d4c-880a-6edb90606fd8','29232cdf-9323-42fd-ade2-1d097af3e4de','be2f45a1-457d-42af-a067-6ec1fa63bc45','7be44c8a-adaf-4e2a-84d6-ab2649e08a13','e8611ab8-c189-46e8-94e1-60213ab1f814']);\r\nAuditLogs\r\n| where OperationName == \"Add member to role\"\r\n| mv-expand TargetResources\r\n| extend RoleId = tostring(TargetResources.modifiedProperties[0].newValue)\r\n| extend RoleName = tostring(TargetResources.modifiedProperties[1].newValue)\r\n| where RoleId in (critical,high)\r\n| extend TargetId = tostring(TargetResources.id)\r\n| extend Target = tostring(TargetResources.userPrincipalName)\r\n| where isnotempty(RoleId) or isnotempty(RoleName)\r\n| join kind=inner ( BehaviorAnalytics\r\n) on $left._ItemId == $right.SourceRecordId\r\n| where UsersInsights.BlasrRadius == \"High\" or ActivityInsights has \"True\"\r\n| project TimeGenerated, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target,RoleName,ActivityInsights ,SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| summarize count() by UserPrincipalName\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Anomalous Role Assignment", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "IPAddress", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ] }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results130", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results130", "styleSettings": { "maxWidth": "50" } } ] }, "conditionalVisibility": { "parameterName": "isBehaviorLogsVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Behavior Logs Group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "7afa304d-b448-4d6c-8c54-69e51a7249a9", "version": "KqlParameterItem/1.0", "name": "Results46", "type": 1, "query": "SigninLogs\r\n| where Location <> \"\"\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results46", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "e7de4575-c167-4818-8820-ec17513a02b2", "version": "KqlParameterItem/1.0", "name": "Results47", "type": 1, "query": "let nonInteractive = AADNonInteractiveUserSignInLogs\r\n| extend LocationDetails = parse_json(LocationDetails)\r\n| extend Status = parse_json(Status);\r\nlet data = \r\nunion SigninLogs,nonInteractive\r\n|extend errorCode = Status.errorCode\r\n|extend SigninStatus = case(errorCode == 0, \"Success\", errorCode == 50058, \"Pending user action\",errorCode == 50140, \"Pending user action\", errorCode == 51006, \"Pending user action\", errorCode == 50059, \"Pending user action\",errorCode == 65001, \"Pending user action\", errorCode == 52004, \"Pending user action\", errorCode == 50055, \"Pending user action\", errorCode == 50144, \"Pending user action\", errorCode == 50072, \"Pending user action\", errorCode == 50074, \"Pending user action\", errorCode == 16000, \"Pending user action\", errorCode == 16001, \"Pending user action\", errorCode == 16003, \"Pending user action\", errorCode == 50127, \"Pending user action\", errorCode == 50125, \"Pending user action\", errorCode == 50129, \"Pending user action\", errorCode == 50143, \"Pending user action\", errorCode == 81010, \"Pending user action\", errorCode == 81014, \"Pending user action\", errorCode == 81012 ,\"Pending user action\", \"Failure\");\r\ndata\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| where IsInteractive == true\r\n| summarize Count = count() by SigninStatus\r\n| join kind = fullouter (datatable(SigninStatus:string)['Success', 'Pending action (Interrupts)', 'Failure']) on SigninStatus\r\n| project SigninStatus = iff(SigninStatus == '', SigninStatus1, SigninStatus), Count = iff(SigninStatus == '', 0, Count)\r\n| join kind = inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SigninStatus)\r\n on SigninStatus\r\n| project-away SigninStatus1, TimeGenerated\r\n| extend Status = SigninStatus\r\n| union (\r\n data \r\n | summarize Count = count()\r\n | extend jkey = 1\r\n | join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n | extend jkey = 1) on jkey\r\n | extend SigninStatus = 'All Sign-ins', Status = '*' \r\n)\r\n| where SigninStatus <> \"All Sign-ins\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results47", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "e62c1567-e61e-4acd-9731-d6a2c59bf3a0", "version": "KqlParameterItem/1.0", "name": "Results48", "type": 1, "query": "SigninLogs\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| where ResultType == 0 and AppDisplayName != \"\"\r\n| summarize count() by AppDisplayName\r\n| join (\r\nSigninLogs\r\n| make-series TrendList = count() on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, 4h) by AppDisplayName \r\n) on AppDisplayName\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results48", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "48559d4f-7025-4580-b316-2134c07b7ad7", "version": "KqlParameterItem/1.0", "name": "Results49", "type": 1, "query": "SigninLogs\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| where IsInteractive == true\r\n| extend city_ = tostring(LocationDetails.city)\r\n| extend state_ = tostring(LocationDetails.state)\r\n| where state_ <> \"\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results49", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "d0eea57b-83c9-41b1-affe-043b15594e1a", "version": "KqlParameterItem/1.0", "name": "Results50", "type": 1, "query": "SigninLogs\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| where isnotempty(LocationDetails['countryOrRegion']) and ResultType == 0// Where location details are available and login is successfull\r\n| extend city = tostring(LocationDetails['city'])\r\n| summarize count() by city, Location // Summarize by city name\r\n| join (\r\nSigninLogs\r\n| extend city = tostring(LocationDetails['city'])\r\n| make-series TrendList = count() on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by city \r\n) on city\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results50", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "88a39c54-0e1f-4f7f-b7f7-a3e798a26b4e", "version": "KqlParameterItem/1.0", "name": "Results51", "type": 1, "query": "SigninLogs\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results51", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "08ed6d78-dbc0-4d10-84da-e37fae50ba4e", "version": "KqlParameterItem/1.0", "name": "Results52", "type": 1, "query": "SigninLogs\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| extend browser_ = tostring(DeviceDetail.browser)\r\n| extend operatingSystem_ = tostring(DeviceDetail.operatingSystem)\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results52", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "66899fa7-9a59-4fee-882c-3d182a726a49", "version": "KqlParameterItem/1.0", "name": "Results53", "type": 1, "query": "SigninLogs\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n// Forces Log Analytics to recognize that the query should be run over full time range\r\n| extend locationString= strcat(tostring(LocationDetails[\"countryOrRegion\"]), \"/\", \r\n tostring(LocationDetails[\"state\"]), \"/\", tostring(LocationDetails[\"city\"]), \";\") \r\n| project TimeGenerated, AppDisplayName, UserPrincipalName, locationString \r\n// Create time series \r\n| make-series dLocationCount = dcount(locationString)\r\n on TimeGenerated\r\n step 1d\r\n by UserPrincipalName, AppDisplayName \r\n// Compute best fit line for each entry \r\n| extend (RSquare, Slope, Variance, RVariance, Interception, LineFit) = series_fit_line(dLocationCount) \r\n// Chart the 3 most interesting lines \r\n// A 0-value slope corresponds to an account being completely stable over time for a given Azure Active Directory application\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results53", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "82dfffd6-7e78-4412-a69b-5d3d096a4e94", "version": "KqlParameterItem/1.0", "name": "Results54", "type": 1, "query": "SigninLogs\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n// 50126 - Invalid username or password, or invalid on-premises username or password.\r\n// 50020? - The user doesn't exist in the tenant.\r\n| where ResultType in (\"50126\", \"50020\")\r\n| extend OS = DeviceDetail.operatingSystem, Browser = DeviceDetail.browser\r\n| extend StatusCode = tostring(Status.errorCode), StatusDetails = tostring(Status.additionalDetails)\r\n| extend State = tostring(LocationDetails.state), City = tostring(LocationDetails.city)\r\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), IPAddresses = makeset(IPAddress), DistinctIPCount = dcount(IPAddress), \r\n makeset(OS), makeset(Browser), makeset(City), AttemptCount = count() \r\n by UserDisplayName, UserPrincipalName, AppDisplayName, ResultType, ResultDescription, StatusCode, StatusDetails, Location, State\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results54", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "3b974333-5ea4-4a64-9067-0d206e3d91fd", "version": "KqlParameterItem/1.0", "name": "Results55", "type": 1, "query": "let failureCountThreshold = 5;\r\nlet successCountThreshold = 1;\r\nlet authenticationWindow = 20m;\r\nlet aadFunc = (tableName: string) {\r\n table(tableName)\r\n | where UserPrincipalName in ({UserPrincipalName})\r\n | extend DeviceDetail = todynamic(DeviceDetail), Status = todynamic(DeviceDetail), LocationDetails = todynamic(LocationDetails)\r\n | extend OS = DeviceDetail.operatingSystem, Browser = DeviceDetail.browser\r\n | extend StatusCode = tostring(Status.errorCode), StatusDetails = tostring(Status.additionalDetails)\r\n | extend State = tostring(LocationDetails.state), City = tostring(LocationDetails.city), Region = tostring(LocationDetails.countryOrRegion)\r\n // Split out failure versus non-failure types\r\n | extend FailureOrSuccess = iff(ResultType in (\"0\", \"50125\", \"50140\", \"70043\", \"70044\"), \"Success\", \"Failure\")\r\n | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), IPAddress = make_set(IPAddress), make_set(OS), make_set(Browser), make_set(City),\r\n make_set(State), make_set(Region), make_set(ResultType), FailureCount = countif(FailureOrSuccess == \"Failure\"), SuccessCount = countif(FailureOrSuccess == \"Success\") \r\n by bin(TimeGenerated, authenticationWindow), UserDisplayName, UserPrincipalName, AppDisplayName, Type\r\n | where FailureCount >= failureCountThreshold and SuccessCount >= successCountThreshold\r\n | mvexpand IPAddress\r\n | extend IPAddress = tostring(IPAddress)\r\n | extend timestamp = StartTime, AccountCustomEntity = UserPrincipalName, IPCustomEntity = IPAddress \r\n};\r\nlet aadSignin = aadFunc(\"SigninLogs\");\r\nlet aadNonInt = aadFunc(\"AADNonInteractiveUserSignInLogs\");\r\nunion isfuzzy=true aadSignin, aadNonInt\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results55", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "6ae59cc4-9e9a-4392-b946-89e77025f3b3", "version": "KqlParameterItem/1.0", "name": "Results56", "type": 1, "query": "let timeFrame = {TimeRange:grain};\r\nlet logonDiff = 1m;\r\nlet Success = SigninLogs \r\n | where UserPrincipalName in ({UserPrincipalName})\r\n | where TimeGenerated >= timeFrame \r\n | where ResultType == \"0\" \r\n | where AppDisplayName !in (\"Office 365 Exchange Online\", \"Skype for Business Online\", \"Office 365 SharePoint Online\")\r\n | project SuccessLogonTime = TimeGenerated, UserPrincipalName, IPAddress, SuccessAppDisplayName = AppDisplayName;\r\nlet Fail = SigninLogs \r\n | where TimeGenerated >= timeFrame \r\n | where ResultType !in (\"0\", \"50140\") \r\n | where ResultDescription !~ \"Other\" \r\n | where AppDisplayName !in (\"Office 365 Exchange Online\", \"Skype for Business Online\", \"Office 365 SharePoint Online\")\r\n | project FailedLogonTime = TimeGenerated, UserPrincipalName, IPAddress, FailedAppDisplayName = AppDisplayName, ResultType, ResultDescription;\r\nlet InitialDataSet = \r\n Success\r\n | join kind= inner (\r\n Fail\r\n )\r\n on UserPrincipalName, IPAddress \r\n | where isnotempty(FailedAppDisplayName)\r\n | where SuccessLogonTime < FailedLogonTime and FailedLogonTime - SuccessLogonTime <= logonDiff and SuccessAppDisplayName != FailedAppDisplayName;\r\nlet InitialHits = \r\n InitialDataSet\r\n | summarize FailedLogonTime = min(FailedLogonTime), SuccessLogonTime = min(SuccessLogonTime) \r\n by UserPrincipalName, SuccessAppDisplayName, FailedAppDisplayName, IPAddress, ResultType, ResultDescription;\r\n// Only take hits where there is 5 or less distinct AppDisplayNames on the success side as this limits highly active applications where failures occur more regularly\r\nlet Distribution =\r\n InitialDataSet\r\n | summarize count(SuccessAppDisplayName) by SuccessAppDisplayName, ResultType\r\n | where count_SuccessAppDisplayName <= 5;\r\nInitialHits\r\n| join (\r\n Distribution \r\n )\r\n on SuccessAppDisplayName, ResultType\r\n| project UserPrincipalName, SuccessLogonTime, IPAddress, SuccessAppDisplayName, FailedLogonTime, FailedAppDisplayName, ResultType, ResultDescription \r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results56", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "b297d67a-c87f-469d-b50a-df226179f729", "version": "KqlParameterItem/1.0", "name": "Results57", "type": 1, "query": "let signIns = SigninLogs\r\n | where UserPrincipalName in ({UserPrincipalName})\r\n | extend locationString= strcat(tostring(LocationDetails[\"countryOrRegion\"]), \"/\",\r\n tostring(LocationDetails[\"state\"]), \"/\", tostring(LocationDetails[\"city\"]))\r\n | where locationString != \"//\" \r\n // filter out signins associated with top 100 signin locations \r\n | join kind=anti (\r\n SigninLogs\r\n | extend locationString= strcat(tostring(LocationDetails[\"countryOrRegion\"]), \"/\", \r\n tostring(LocationDetails[\"state\"]), \"/\", tostring(LocationDetails[\"city\"]))\r\n | where locationString != \"//\"\r\n | summarize count() by locationString\r\n | order by count_ desc\r\n | take 100)\r\n on locationString; // TODO - make this threshold percentage-based\r\n// We will perform a time window join to identify signins from multiple locations within a 10-minute period\r\nlet lookupWindow = 10m;\r\nlet lookupBin = lookupWindow / 2.0; // lookup bin = equal to 1/2 of the lookup window\r\nsignIns \r\n| project-rename Start=TimeGenerated \r\n| extend TimeKey = bin(Start, lookupBin)\r\n| join kind = inner (\r\n signIns \r\n | project-rename End=TimeGenerated, EndLocationString=locationString \r\n // TimeKey on the right side of the join - emulates this authentication appearing several times\r\n | extend TimeKey = range(bin(End - lookupWindow, lookupBin),\r\n bin(End, lookupBin), lookupBin)\r\n | mvexpand TimeKey to typeof(datetime) // translate TimeKey arrange range to a column\r\n )\r\n on Identity, TimeKey\r\n| where End > Start\r\n| project timeSpan = End - Start, Identity, locationString, EndLocationString, tostring(Start), tostring(End), UserPrincipalName\r\n| where locationString != EndLocationString\r\n| summarize by timeSpan, Identity, locationString, EndLocationString, Start, End, UserPrincipalName\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results57", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "909d0019-23cb-43ad-8285-9f1dca1cd1be", "version": "KqlParameterItem/1.0", "name": "Results58", "type": 1, "query": "let IP_Data = (externaldata(network: string)\r\n [@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/VPS_Networks.csv\"] with (format=\"csv\"));\r\nSigninLogs\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| where ResultType == 0\r\n| extend additionalDetails = tostring(Status.additionalDetails)\r\n| evaluate ipv4_lookup(IP_Data, IPAddress, network, return_unmatched = false)\r\n| summarize make_set(additionalDetails), min(TimeGenerated), max(TimeGenerated) by IPAddress, UserPrincipalName\r\n// Uncomment the remaining lines to only see logons from VPS providers with token only logons.\r\n//| where array_length(set_additionalDetails) == 2\r\n//| where (set_additionalDetails[1] == \"MFA requirement satisfied by claim in the token\" and set_additionalDetails[0] == \"MFA requirement satisfied by claim provided by external provider\") or (set_additionalDetails[0] == \"MFA requirement satisfied by claim in the token\" and set_additionalDetails[1] == \"MFA requirement satisfied by claim provided by external provider\")\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results58", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "9f9017d7-ba1e-4bac-8a15-89c65b213746", "version": "KqlParameterItem/1.0", "name": "Spacer", "type": 1, "query": "", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "25", "name": "Spacer", "styleSettings": { "maxWidth": "25" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Sign-Ins](https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-sign-ins)\n---\n\nSign-In logging provide information about sign-ins and how your resources are used by your users.These logs help to identify user authentication patterns, quantify of sign-ins over time, and status of authentications. These logs include interactive events, non-interactive user sign-ins, service principal sign-ins, and managed identities. \n\n\n\n" }, "name": "text - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "4a388baf-b1ed-4d69-9b31-58039271c260", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Entra ID >>", "style": "secondary", "bladeOpenContext": { "bladeName": "ActiveDirectoryMenuBlade", "extensionName": "Microsoft_AAD_IAM", "bladeParameters": [] } } ] }, "customWidth": "50", "name": "EL0" } ] }, "customWidth": "40", "name": "group - 32" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 29" }, { "type": 1, "content": { "json": "| Authentication Queries | - | - |\r\n|:--| :--| :--| \r\n| Sign-Ins by Geolocation | Authentication Details | Sign-Ins by Application Count |\r\n| Sign-Ins by Location Over Time | Sign-Ins by Region | Applications Accessed |\r\n| Client Applications | Anomalous Sign-in & App Access | Failed Attempt to Access Microsoft Portal |\r\n| Brute Force Against a Microsoft Portal | Sign-In Success Followed by Fail | Sign-in From VPN |\r\n|Sign-In Burst from Multiple Locations | EntraID User Profile | Identity Information |\r\n\r\nThis section is bound by the above parameters for Subscription, Workspace, TimeRange, and User. Panels are dynamically displayed meaning numerous queries are executed and only panels returning data are displayed. " }, "customWidth": "40", "name": "SI OV" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| where Location <> \"\"\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| extend latitude_ = tostring(parse_json(tostring(LocationDetails.geoCoordinates)).latitude)\r\n| extend longitude_ = tostring(parse_json(tostring(LocationDetails.geoCoordinates)).longitude)\r\n| extend city_ = tostring(LocationDetails.city)", "size": 3, "showAnalytics": true, "title": "Sign-Ins by Geolocation", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "map", "mapSettings": { "locInfo": "LatLong", "locInfoColumn": "Location", "latitude": "latitude_", "longitude": "longitude_", "sizeSettings": "city_", "sizeAggregation": "Count", "labelSettings": "city_", "legendMetric": "city_", "numberOfMetrics": 100, "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "state_", "colorAggregation": "Count", "type": "heatmap", "heatmapPalette": "coldHot" } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results46", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results46" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let nonInteractive = AADNonInteractiveUserSignInLogs\r\n| extend LocationDetails = parse_json(LocationDetails)\r\n| extend Status = parse_json(Status);\r\nlet data = \r\nunion SigninLogs,nonInteractive\r\n|extend errorCode = Status.errorCode\r\n|extend SigninStatus = case(errorCode == 0, \"Success\", errorCode == 50058, \"Pending user action\",errorCode == 50140, \"Pending user action\", errorCode == 51006, \"Pending user action\", errorCode == 50059, \"Pending user action\",errorCode == 65001, \"Pending user action\", errorCode == 52004, \"Pending user action\", errorCode == 50055, \"Pending user action\", errorCode == 50144, \"Pending user action\", errorCode == 50072, \"Pending user action\", errorCode == 50074, \"Pending user action\", errorCode == 16000, \"Pending user action\", errorCode == 16001, \"Pending user action\", errorCode == 16003, \"Pending user action\", errorCode == 50127, \"Pending user action\", errorCode == 50125, \"Pending user action\", errorCode == 50129, \"Pending user action\", errorCode == 50143, \"Pending user action\", errorCode == 81010, \"Pending user action\", errorCode == 81014, \"Pending user action\", errorCode == 81012 ,\"Pending user action\", \"Failure\");\r\ndata\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| where IsInteractive == true\r\n| summarize Count = count() by SigninStatus\r\n| join kind = fullouter (datatable(SigninStatus:string)['Success', 'Pending action (Interrupts)', 'Failure']) on SigninStatus\r\n| project SigninStatus = iff(SigninStatus == '', SigninStatus1, SigninStatus), Count = iff(SigninStatus == '', 0, Count)\r\n| join kind = inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SigninStatus)\r\n on SigninStatus\r\n| project-away SigninStatus1, TimeGenerated\r\n| extend Status = SigninStatus\r\n| union (\r\n data \r\n | summarize Count = count()\r\n | extend jkey = 1\r\n | join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n | extend jkey = 1) on jkey\r\n | extend SigninStatus = 'All Sign-ins', Status = '*' \r\n)\r\n| where SigninStatus <> \"All Sign-ins\"\r\n", "size": 0, "showAnalytics": true, "title": "Authentication Details", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "User", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "info", "text": "{0}{1}" } ] } }, { "columnMatch": "Activities", "formatter": 8, "formatOptions": { "palette": "blue" } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "LatLong", "locInfoColumn": "Location", "latitude": "latitude_", "longitude": "longitude_", "sizeSettings": "city_", "sizeAggregation": "Count", "labelSettings": "city_", "legendMetric": "city_", "numberOfMetrics": 100, "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "state_", "colorAggregation": "Count", "type": "heatmap", "heatmapPalette": "coldHot" } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results47", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results47" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| where ResultType == 0\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| extend UserProfile = strcat(\"#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/\",UserId)\r\n| summarize count() by UserPrincipalName, UserProfile, UserId\r\n| sort by count_ desc\r\n| limit 2500\r\n", "size": 0, "showAnalytics": true, "title": "EntraID User Profiles", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "UserProfile", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "EntraID User Profile >>", "bladeOpenContext": { "bladeName": "UserDetailsMenuBlade", "extensionName": "Microsoft_AAD_IAM", "bladeParameters": [ { "name": "userId", "source": "column", "value": "UserId" } ] } } }, { "columnMatch": "UserId", "formatter": 5 }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "blue" } } ], "rowLimit": 2500, "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "query - 1 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "IdentityInfo\r\n| where AccountUPN in ({UserPrincipalName})\r\n| project AccountUPN, GivenName, Surname, GroupMembership, Department, JobTitle , IsAccountEnabled, UserType\r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "Identity Information", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AccountUPN", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "UserProfile", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to User Profile >" } }, { "columnMatch": "UserRoles", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Roles >" } }, { "columnMatch": "AdminRoles", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to AdminRoles >" } }, { "columnMatch": "Groups", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Groups >" } }, { "columnMatch": "Applications", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Apps >" } }, { "columnMatch": "Licenses", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Licenses >" } }, { "columnMatch": "Devices", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Devices >" } }, { "columnMatch": "AzureRoles", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to AzureRoles >" } }, { "columnMatch": "SignIns", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to SignIns >" } }, { "columnMatch": "AuditLogs", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to AuditLogs >" } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "AzureActiveDirectoryProfile", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to EntraID Profile >" } }, { "columnMatch": "IncidentCount", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "AlertCount", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "AnomalyCount", "formatter": 8, "formatOptions": { "palette": "yellow" } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "query - 32" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| where ResultType == 0 and AppDisplayName != \"\"\r\n| summarize count() by AppDisplayName\r\n| join (\r\nSigninLogs\r\n| make-series TrendList = count() on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, 4h) by AppDisplayName \r\n) on AppDisplayName\r\n| top 10 by count_ desc", "size": 4, "showAnalytics": true, "title": "Sign-Ins By Application", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "User", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "info", "text": "{0}{1}" } ] } }, { "columnMatch": "Activities", "formatter": 8, "formatOptions": { "palette": "blue" } } ] }, "tileSettings": { "titleContent": { "columnMatch": "AppDisplayName", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "secondaryContent": { "columnMatch": "TrendList", "formatter": 9, "formatOptions": { "showIcon": true } }, "showBorder": false }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "AppDisplayName", "formatter": 1 }, "centerContent": { "columnMatch": "count_", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "mapSettings": { "locInfo": "LatLong", "locInfoColumn": "Location", "latitude": "latitude_", "longitude": "longitude_", "sizeSettings": "city_", "sizeAggregation": "Count", "labelSettings": "city_", "legendMetric": "city_", "numberOfMetrics": 100, "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "state_", "colorAggregation": "Count", "type": "heatmap", "heatmapPalette": "coldHot" } } }, "conditionalVisibility": { "parameterName": "Results48", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results48" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| where IsInteractive == true\r\n| extend city_ = tostring(LocationDetails.city)\r\n| extend state_ = tostring(LocationDetails.state)\r\n| where state_ <> \"\"\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by state_\r\n| render timechart\r\n", "size": 0, "showAnalytics": true, "title": "Sign-In Locations Over Time", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "conditionalVisibility": { "parameterName": "Results49", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results49" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| where isnotempty(LocationDetails['countryOrRegion']) and ResultType == 0// Where location details are available and login is successfull\r\n| extend city = tostring(LocationDetails['city'])\r\n| summarize count() by city, Location // Summarize by city name\r\n| join (\r\nSigninLogs\r\n| extend city = tostring(LocationDetails['city'])\r\n| make-series TrendList = count() on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by city \r\n) on city\r\n| project Location, city, [\"Total events\"] = count_, TrendLine = TrendList\r\n| top 10 by [\"Total events\"] desc\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Sign-Ins by Region", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Total events", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "TrendLine", "formatter": 9, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ], "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results50", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results50", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| summarize count() by UserPrincipalName, AppDisplayName\r\n| sort by count_ desc\r\n| limit 250\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Applications Accessed", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "AppDisplayName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "trendup", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "IPAddress", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } } ], "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results51", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results51", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| extend browser_ = tostring(DeviceDetail.browser)\r\n| extend operatingSystem_ = tostring(DeviceDetail.operatingSystem)\r\n| summarize count() by UserPrincipalName, browser_, operatingSystem_\r\n| sort by count_ desc\r\n| limit 250\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Client Applications", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "UserAgent", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "1", "text": "{0}{1}" } ] } }, { "columnMatch": "ClientAppUsed", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "trenddown", "text": "{0}{1}" } ] } }, { "columnMatch": "AppDisplayName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "trendup", "text": "{0}{1}" } ] } }, { "columnMatch": "IPAddress", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } } ], "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results52", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results52", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n// Forces Log Analytics to recognize that the query should be run over full time range\r\n| extend locationString= strcat(tostring(LocationDetails[\"countryOrRegion\"]), \"/\", \r\n tostring(LocationDetails[\"state\"]), \"/\", tostring(LocationDetails[\"city\"]), \";\") \r\n| project TimeGenerated, AppDisplayName, UserPrincipalName, locationString \r\n// Create time series \r\n| make-series dLocationCount = dcount(locationString)\r\n on TimeGenerated\r\n step 1d\r\n by UserPrincipalName, AppDisplayName \r\n// Compute best fit line for each entry \r\n| extend (RSquare, Slope, Variance, RVariance, Interception, LineFit) = series_fit_line(dLocationCount) \r\n// Chart the 3 most interesting lines \r\n// A 0-value slope corresponds to an account being completely stable over time for a given Azure Active Directory application\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| summarize count() by UserPrincipalName, AppDisplayName\r\n| sort by count_ desc\r\n| limit 250\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Anomalous Sign-in Location by User Account and Authenticating Application", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ], "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results53", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results53", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n// 50126 - Invalid username or password, or invalid on-premises username or password.\r\n// 50020? - The user doesn't exist in the tenant.\r\n| where ResultType in (\"50126\", \"50020\")\r\n| extend OS = DeviceDetail.operatingSystem, Browser = DeviceDetail.browser\r\n| extend StatusCode = tostring(Status.errorCode), StatusDetails = tostring(Status.additionalDetails)\r\n| extend State = tostring(LocationDetails.state), City = tostring(LocationDetails.city)\r\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), IPAddresses = makeset(IPAddress), DistinctIPCount = dcount(IPAddress), \r\n makeset(OS), makeset(Browser), makeset(City), AttemptCount = count() \r\n by UserDisplayName, UserPrincipalName, AppDisplayName, ResultType, ResultDescription, StatusCode, StatusDetails, Location, State\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| summarize count() by UserPrincipalName, AppDisplayName\r\n| sort by count_ desc\r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "User Failed Attempt to Access Microsoft Portal", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ], "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results54", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results54", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let failureCountThreshold = 5;\r\nlet successCountThreshold = 1;\r\nlet authenticationWindow = 20m;\r\nlet aadFunc = (tableName: string) {\r\n table(tableName)\r\n | where UserPrincipalName in ({UserPrincipalName})\r\n | extend DeviceDetail = todynamic(DeviceDetail), Status = todynamic(DeviceDetail), LocationDetails = todynamic(LocationDetails)\r\n | extend OS = DeviceDetail.operatingSystem, Browser = DeviceDetail.browser\r\n | extend StatusCode = tostring(Status.errorCode), StatusDetails = tostring(Status.additionalDetails)\r\n | extend State = tostring(LocationDetails.state), City = tostring(LocationDetails.city), Region = tostring(LocationDetails.countryOrRegion)\r\n // Split out failure versus non-failure types\r\n | extend FailureOrSuccess = iff(ResultType in (\"0\", \"50125\", \"50140\", \"70043\", \"70044\"), \"Success\", \"Failure\")\r\n | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), IPAddress = make_set(IPAddress), make_set(OS), make_set(Browser), make_set(City),\r\n make_set(State), make_set(Region), make_set(ResultType), FailureCount = countif(FailureOrSuccess == \"Failure\"), SuccessCount = countif(FailureOrSuccess == \"Success\") \r\n by bin(TimeGenerated, authenticationWindow), UserDisplayName, UserPrincipalName, AppDisplayName, Type\r\n | where FailureCount >= failureCountThreshold and SuccessCount >= successCountThreshold\r\n | mvexpand IPAddress\r\n | extend IPAddress = tostring(IPAddress)\r\n | extend timestamp = StartTime, AccountCustomEntity = UserPrincipalName, IPCustomEntity = IPAddress \r\n};\r\nlet aadSignin = aadFunc(\"SigninLogs\");\r\nlet aadNonInt = aadFunc(\"AADNonInteractiveUserSignInLogs\");\r\nunion isfuzzy=true aadSignin, aadNonInt\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| summarize count() by UserPrincipalName, AppDisplayName\r\n| sort by count_ desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "User Brute Force Against a Microsoft Portal", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ], "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results55", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results55", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let timeFrame = {TimeRange:grain};\r\nlet logonDiff = 1m;\r\nlet Success = SigninLogs \r\n | where UserPrincipalName in ({UserPrincipalName})\r\n | where TimeGenerated >= timeFrame \r\n | where ResultType == \"0\" \r\n | where AppDisplayName !in (\"Office 365 Exchange Online\", \"Skype for Business Online\", \"Office 365 SharePoint Online\")\r\n | project SuccessLogonTime = TimeGenerated, UserPrincipalName, IPAddress, SuccessAppDisplayName = AppDisplayName;\r\nlet Fail = SigninLogs \r\n | where TimeGenerated >= timeFrame \r\n | where ResultType !in (\"0\", \"50140\") \r\n | where ResultDescription !~ \"Other\" \r\n | where AppDisplayName !in (\"Office 365 Exchange Online\", \"Skype for Business Online\", \"Office 365 SharePoint Online\")\r\n | project FailedLogonTime = TimeGenerated, UserPrincipalName, IPAddress, FailedAppDisplayName = AppDisplayName, ResultType, ResultDescription;\r\nlet InitialDataSet = \r\n Success\r\n | join kind= inner (\r\n Fail\r\n )\r\n on UserPrincipalName, IPAddress \r\n | where isnotempty(FailedAppDisplayName)\r\n | where SuccessLogonTime < FailedLogonTime and FailedLogonTime - SuccessLogonTime <= logonDiff and SuccessAppDisplayName != FailedAppDisplayName;\r\nlet InitialHits = \r\n InitialDataSet\r\n | summarize FailedLogonTime = min(FailedLogonTime), SuccessLogonTime = min(SuccessLogonTime) \r\n by UserPrincipalName, SuccessAppDisplayName, FailedAppDisplayName, IPAddress, ResultType, ResultDescription;\r\n// Only take hits where there is 5 or less distinct AppDisplayNames on the success side as this limits highly active applications where failures occur more regularly\r\nlet Distribution =\r\n InitialDataSet\r\n | summarize count(SuccessAppDisplayName) by SuccessAppDisplayName, ResultType\r\n | where count_SuccessAppDisplayName <= 5;\r\nInitialHits\r\n| join (\r\n Distribution \r\n )\r\n on SuccessAppDisplayName, ResultType\r\n| project UserPrincipalName, SuccessLogonTime, IPAddress, SuccessAppDisplayName, FailedLogonTime, FailedAppDisplayName, ResultType, ResultDescription \r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| summarize count() by UserPrincipalName, SuccessAppDisplayName, FailedAppDisplayName\r\n| sort by count_ desc\r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "Successful Sign-in on App Followed by Failed Sign-in on Different App", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "SuccessAppDisplayName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "FailedAppDisplayName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "failed", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ], "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results56", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results56", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let signIns = SigninLogs\r\n | where UserPrincipalName in ({UserPrincipalName})\r\n | extend locationString= strcat(tostring(LocationDetails[\"countryOrRegion\"]), \"/\",\r\n tostring(LocationDetails[\"state\"]), \"/\", tostring(LocationDetails[\"city\"]))\r\n | where locationString != \"//\" \r\n // filter out signins associated with top 100 signin locations \r\n | join kind=anti (\r\n SigninLogs\r\n | extend locationString= strcat(tostring(LocationDetails[\"countryOrRegion\"]), \"/\", \r\n tostring(LocationDetails[\"state\"]), \"/\", tostring(LocationDetails[\"city\"]))\r\n | where locationString != \"//\"\r\n | summarize count() by locationString\r\n | order by count_ desc\r\n | take 100)\r\n on locationString; // TODO - make this threshold percentage-based\r\n// We will perform a time window join to identify signins from multiple locations within a 10-minute period\r\nlet lookupWindow = 10m;\r\nlet lookupBin = lookupWindow / 2.0; // lookup bin = equal to 1/2 of the lookup window\r\nsignIns \r\n| project-rename Start=TimeGenerated \r\n| extend TimeKey = bin(Start, lookupBin)\r\n| join kind = inner (\r\n signIns \r\n | project-rename End=TimeGenerated, EndLocationString=locationString \r\n // TimeKey on the right side of the join - emulates this authentication appearing several times\r\n | extend TimeKey = range(bin(End - lookupWindow, lookupBin),\r\n bin(End, lookupBin), lookupBin)\r\n | mvexpand TimeKey to typeof(datetime) // translate TimeKey arrange range to a column\r\n )\r\n on Identity, TimeKey\r\n| where End > Start\r\n| project timeSpan = End - Start, Identity, locationString, EndLocationString, tostring(Start), tostring(End), UserPrincipalName\r\n| where locationString != EndLocationString\r\n| summarize by timeSpan, Identity, locationString, EndLocationString, Start, End, UserPrincipalName\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| summarize count() by UserPrincipalName, locationString, EndLocationString\r\n| sort by count_ desc\r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "Sign-In Burst From Multiple Locations", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ], "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results57", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results57", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let IP_Data = (externaldata(network: string)\r\n [@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/VPS_Networks.csv\"] with (format=\"csv\"));\r\nSigninLogs\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| where ResultType == 0\r\n| extend additionalDetails = tostring(Status.additionalDetails)\r\n| evaluate ipv4_lookup(IP_Data, IPAddress, network, return_unmatched = false)\r\n| summarize count() by UserPrincipalName, AppDisplayName, network\r\n| sort by count_ desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Sign-Ins From VPNs", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ], "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results58", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results58", "styleSettings": { "maxWidth": "50" } } ] }, "conditionalVisibility": { "parameterName": "isSignInsVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Sign-Ins" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "7afa304d-b448-4d6c-8c54-69e51a7249a9", "version": "KqlParameterItem/1.0", "name": "Results64", "type": 1, "query": "AzureActivity\r\n| where Caller in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results64", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "24eac888-2435-44f0-9e0c-d0490a124a24", "version": "KqlParameterItem/1.0", "name": "Results65", "type": 1, "query": "let data = AuditLogs\r\n| extend UserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n | where \"All\" == \"All\" or Result in ('All')\r\n | extend initiator = iif (tostring(InitiatedBy.user.userPrincipalName) != \"\", tostring(InitiatedBy.user.userPrincipalName), \"unknown\")\r\n | where \"All\" == \"All\" or initiator in ('All')\r\n | where \"All\" == \"All\" or Category in ('All')\r\n | where Category == 'All' or 'All' == \"All\";\r\nlet appData = data\r\n | summarize TotalCount = count() by OperationName, Category\r\n | join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated in range(ago(7d), now(), 3h) by OperationName\r\n | project-away TimeGenerated)\r\n on OperationName\r\n | order by TotalCount desc, OperationName asc\r\n | project OperationName, TotalCount, Trend, Category\r\n | serialize Id = row_number();\r\ndata\r\n| summarize TotalCount = count() by initiator = iif (tostring(InitiatedBy.user.userPrincipalName) != \"\", tostring(InitiatedBy.user.userPrincipalName), \"unknown\"), Category, OperationName\r\n| join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated in range(ago(7d), now(), 3h) by OperationName, initiator = iif (tostring(InitiatedBy.user.userPrincipalName) != \"\", tostring(InitiatedBy.user.userPrincipalName), \"unknown\")\r\n | project-away TimeGenerated)\r\n on OperationName, initiator\r\n| order by TotalCount desc, OperationName asc\r\n| project OperationName, initiator, TotalCount, Category, Trend\r\n| serialize Id = row_number(1000000)\r\n| join kind=inner (appData) on OperationName\r\n| project Id, Name = initiator, Type = 'initiator', ['Operations Count'] = TotalCount, Trend, Category, ParentId = Id1\r\n| union (appData \r\n | project Id, Name = OperationName, Type = 'Operation', ['Operations Count'] = TotalCount, Category, Trend)\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results65", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "52271f7e-fe90-4d96-aa88-4d84d53a3811", "version": "KqlParameterItem/1.0", "name": "Results66", "type": 1, "query": "AzureActivity\r\n| where Caller in ({UserPrincipalName})\r\n| summarize Count = count() by ResourceGroup\r\n| join kind = fullouter (datatable(ResourceGroup:string)['Medium', 'high', 'low']) on ResourceGroup\r\n| project ResourceGroup = iff(ResourceGroup == '', ResourceGroup1, ResourceGroup), Count = iff(ResourceGroup == '', 0, Count)\r\n| join kind = inner (AzureActivity\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ResourceGroup)\r\n on ResourceGroup\r\n| project-away ResourceGroup1, TimeGenerated\r\n| extend ResourceGroups = ResourceGroup\r\n| union (\r\n AzureActivity\r\n | summarize Count = count() \r\n | extend jkey = 1\r\n | join kind=inner (AzureActivity\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n | extend jkey = 1) on jkey\r\n | extend ResourceGroup = 'All', ResourceGroups = '*' \r\n)\r\n| take 10\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results66", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "81c2f458-845a-46a5-bf87-081e5909df27", "version": "KqlParameterItem/1.0", "name": "Results67", "type": 1, "query": "let opValues = dynamic([\"microsoft.insights/workbooks/write\", \"microsoft.insights/workbooks/delete\"]);\r\n// Microsoft Sentinel Workbook Create / Update / Delete\r\nAzureActivity\r\n| where Caller in ({UserPrincipalName})\r\n| where Category == \"Administrative\"\r\n| where OperationNameValue in (opValues)\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| where Caller in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results67", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "948780e8-672d-4e7d-99cd-28bf10e28abc", "version": "KqlParameterItem/1.0", "name": "Results68", "type": 1, "query": "AzureActivity\r\n| where Caller in ({UserPrincipalName})\r\n| where OperationName == \"List Storage Account Keys\"\r\n| where ActivityStatus == \"Succeeded\" \r\n| join kind= inner (\r\n AzureActivity\r\n | where OperationName == \"List Storage Account Keys\"\r\n | where ActivityStatus == \"Succeeded\" \r\n | project ExpectedIpAddress=CallerIpAddress, Caller \r\n | evaluate autocluster()\r\n )\r\n on Caller \r\n| where CallerIpAddress != ExpectedIpAddress\r\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), ResourceIds = makeset(ResourceId), ResourceIdCount = dcount(ResourceId) by OperationName, Caller, CallerIpAddress\r\n| where Caller in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results68", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "9daf2582-119f-479c-8efe-9aef4abd5db8", "version": "KqlParameterItem/1.0", "name": "Results69", "type": 1, "query": "let opValues = dynamic([\"Microsoft.SecurityInsights/alertRules/write\", \"Microsoft.SecurityInsights/alertRules/delete\"]);\r\n// Microsoft Sentinel Analytics - Rule Create / Update / Delete\r\nAzureActivity\r\n| where Caller in ({UserPrincipalName})\r\n| where Category == \"Administrative\"\r\n| where OperationNameValue in (opValues)\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| where Caller in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results69", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "7cc8ad5e-0d54-42fb-a5c7-4a1136066cc2", "version": "KqlParameterItem/1.0", "name": "Results70", "type": 1, "query": "AzureActivity\r\n| where Caller in ({UserPrincipalName})\r\n| where OperationName == \"Create or Update Virtual Machine\" or OperationName == \"Create Deployment\" \r\n| where ActivityStatus == \"Succeeded\" \r\n| project Resource, ResourceGroup, Caller\r\n| evaluate basket()\r\n| where Percent <= 30\r\n| where Caller in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results70", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "329cd1b9-17ab-4179-b502-600d35c08f97", "version": "KqlParameterItem/1.0", "name": "Results71", "type": 1, "query": "AzureActivity\r\n| where Caller in ({UserPrincipalName})\r\n| where OperationName == \"Create role assignment\"\r\n| where ActivityStatus == \"Succeeded\" \r\n| project Caller, CallerIpAddress\r\n| evaluate basket()\r\n| join kind=leftouter (AzureActivity\r\n | where OperationName == \"Create role assignment\"\r\n | where ActivityStatus == \"Succeeded\"\r\n | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by Caller, CallerIpAddress)\r\n on Caller, CallerIpAddress\r\n| project-away Caller1, CallerIpAddress1\r\n| where Caller in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results71", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "0aeb13f5-7f28-49a7-9313-778d1b25f530", "version": "KqlParameterItem/1.0", "name": "Results72", "type": 1, "query": "let opValues = dynamic([\"Microsoft.SecurityInsights/dataConnectors/write\", \"Microsoft.SecurityInsights/dataConnectors/delete\"]);\r\n// Microsoft Sentinel Data Connectors Update / Delete\r\nAzureActivity\r\n| where Caller in ({UserPrincipalName})\r\n| where Category == \"Administrative\"\r\n| where OperationNameValue in (opValues)\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| where Caller in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results72", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "d1cc625e-0cda-4497-8c14-c0fa163df6fc", "version": "KqlParameterItem/1.0", "name": "Results73", "type": 1, "query": "AzureActivity\r\n| where Caller in ({UserPrincipalName})\r\n| where OperationName has_any (\"Create\", \"Update\") and OperationName has_any (\"Ip\", \"Security Rule\")\r\n// Choosing Accepted here because it has the Rule Attributes included\r\n| where ActivityStatus == \"Accepted\" \r\n// If there is publicIP info, include it\r\n| extend publicIPAddress_ = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).ipAddress) \r\n| extend publicIPAddressVersion_ = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).publicIPAddressVersion) \r\n| extend publicIPAllocationMethod_ = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).publicIPAllocationMethod) \r\n// Include rule attributes for context\r\n| extend access = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).access) \r\n| extend description = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).description) \r\n| extend destinationPortRange = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).destinationPortRange) \r\n| extend direction = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).direction) \r\n| extend protocol = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).protocol) \r\n| extend sourcePortRange = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).sourcePortRange) \r\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), ResourceIds = makeset(ResourceId)\r\n by Caller, CallerIpAddress, Resource, ResourceGroup, \r\n ActivityStatus, ActivitySubstatus, SubscriptionId, access, description, destinationPortRange, direction, protocol, sourcePortRange \r\n| where Caller in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results73", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "5b49fb4c-0fd4-4948-af1a-e4d2e262f8b8", "version": "KqlParameterItem/1.0", "name": "Results74", "type": 1, "query": "AzureActivity\r\n| where Caller in ({UserPrincipalName})\r\n| where ResourceGroup has \"cloud-shell-storage\"\r\n| where Caller in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results74", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "c11195ea-b375-4942-be82-70727a721b41", "version": "KqlParameterItem/1.0", "name": "Results75", "type": 1, "query": "let opValues = dynamic([\"Microsoft.Network/networkSecurityGroups/write\", \"Microsoft.Network/networkSecurityGroups/delete\"]);\r\n// Azure NSG Create / Update / Delete\r\nAzureActivity\r\n| where Caller in ({UserPrincipalName})\r\n| where Category == \"Administrative\"\r\n| where OperationNameValue in (opValues)\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| where Caller in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results75", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "650a840b-078f-4f8f-97a5-69222046266d", "version": "KqlParameterItem/1.0", "name": "Results76", "type": 1, "query": "AzureActivity\r\n| where Caller in ({UserPrincipalName})\r\n| where OperationName == \"Create or Update Virtual Machine\" or OperationName == \"Create Deployment\" \r\n| where ActivityStatus == \"Succeeded\" \r\n| summarize count() by Caller, ResourceId\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results76", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "f032072b-8c09-460d-8210-e52d00f0c282", "version": "KqlParameterItem/1.0", "name": "Spacer", "type": 1, "query": "", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "25", "name": "Spacer", "styleSettings": { "maxWidth": "25" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Azure Activity](https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-sign-ins)\n---\n\nThe Activity log is a platform log in Azure that provides insight into subscription-level events. This includes such information as when a resource is modified or when a virtual machine is started. You can view the Activity log in the Azure portal or retrieve entries with PowerShell and CLI. This article provides details on viewing the Activity log and sending it to different destinations. \n\n\n\n" }, "name": "text - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "4a388baf-b1ed-4d69-9b31-58039271c260", "linkTarget": "OpenBlade", "linkLabel": "Azure Monitor >>", "style": "secondary", "bladeOpenContext": { "bladeName": "AzureMonitoringBrowseBlade", "extensionName": "Microsoft_Azure_Monitoring", "bladeParameters": [] } } ] }, "customWidth": "50", "name": "EL0" } ] }, "customWidth": "40", "name": "group - 31" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 30" }, { "type": 1, "content": { "json": " \r\n\r\n| Azure Activity Queries | - | - |\r\n|:--| :--| :--|\r\n| Azure Activity over Time | Activity Action Summary | Activities |\r\n| Top 10 Resource Groups Accessed | Storage Key Enumeration | Sentinel Analytics Rules | \r\n| Uncommonly Deployed Resources | Granting Permissions to Account | Sentinel Admin Operations |\r\n| Opening Network Ports | Azure Cloud Shell Usage | Network Security Group Operations |\r\n| Creation of Anomalous Number of Resources | \r\n\r\nThis section is bound by the above parameters for Subscription, Workspace, TimeRange, and User. Panels are dynamically displayed meaning numerous queries are executed and only panels returning data are displayed." }, "customWidth": "40", "name": "AA OV" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where Caller in ({UserPrincipalName})\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by OperationName\r\n| render timechart\r\n\r\n", "size": 0, "showAnalytics": true, "title": "User Azure Activity over Time", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ] }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "conditionalVisibility": { "parameterName": "Results64", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results64" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where Caller in ({UserPrincipalName})\r\n| summarize Deletions = countif(OperationName contains \"Delete\"), Creations = countif(OperationName contains \"Create\"), Updates = countif(OperationName contains \"Update\"), Activities = count() by Caller\r\n", "size": 1, "showAnalytics": true, "title": "Activity Actions Summary", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Caller", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "Deletions", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "Creations", "formatter": 4, "formatOptions": { "palette": "purple" } }, { "columnMatch": "Updates", "formatter": 4, "formatOptions": { "palette": "gray" } }, { "columnMatch": "Activities", "formatter": 4, "formatOptions": { "palette": "greenDark", "linkTarget": "GenericDetails", "linkIsContextBlade": true, "aggregation": "Count", "workbookContext": { "componentIdSource": "workbook", "resourceIdsSource": "workbook", "templateIdSource": "static", "templateId": "https://go.microsoft.com/fwlink/?linkid=874159&resourceId=%2Fsubscriptions%2F44e4eff8-1fcb-4a22-a7d6-992ac7286382%2FresourceGroups%2FSOC&featureName=Workbooks&itemId=%2Fsubscriptions%2F44e4eff8-1fcb-4a22-a7d6-992ac7286382%2Fresourcegroups%2Fsoc%2Fproviders%2Fmicrosoft.insights%2Fworkbooks%2F4c195aec-747f-40bb-addb-934acb3ec646&name=CiscoASA&func=NavigateToPortalFeature&type=workbook", "typeSource": "workbook", "gallerySource": "workbook" } } }, { "columnMatch": "deletions", "formatter": 4, "formatOptions": { "palette": "blue", "aggregation": "Count" } }, { "columnMatch": "creations", "formatter": 4, "formatOptions": { "palette": "purple", "aggregation": "Count" } }, { "columnMatch": "updates", "formatter": 4, "formatOptions": { "palette": "gray", "aggregation": "Count" } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_bar_Activities_4", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_bar_Activities_4", "sortOrder": 2 } ], "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results64", "comparison": "isEqualTo", "value": "Yes" }, "showPin": false, "name": "Results64b" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = AuditLogs\r\n| extend UserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n | where \"All\" == \"All\" or Result in ('All')\r\n | extend initiator = iif (tostring(InitiatedBy.user.userPrincipalName) != \"\", tostring(InitiatedBy.user.userPrincipalName), \"unknown\")\r\n | where \"All\" == \"All\" or initiator in ('All')\r\n | where \"All\" == \"All\" or Category in ('All')\r\n | where Category == 'All' or 'All' == \"All\";\r\nlet appData = data\r\n | summarize TotalCount = count() by OperationName, Category\r\n | join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated in range(ago(7d), now(), 3h) by OperationName\r\n | project-away TimeGenerated)\r\n on OperationName\r\n | order by TotalCount desc, OperationName asc\r\n | project OperationName, TotalCount, Trend, Category\r\n | serialize Id = row_number();\r\ndata\r\n| summarize TotalCount = count() by initiator = iif (tostring(InitiatedBy.user.userPrincipalName) != \"\", tostring(InitiatedBy.user.userPrincipalName), \"unknown\"), Category, OperationName\r\n| join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated in range(ago(7d), now(), 3h) by OperationName, initiator = iif (tostring(InitiatedBy.user.userPrincipalName) != \"\", tostring(InitiatedBy.user.userPrincipalName), \"unknown\")\r\n | project-away TimeGenerated)\r\n on OperationName, initiator\r\n| order by TotalCount desc, OperationName asc\r\n| project OperationName, initiator, TotalCount, Category, Trend\r\n| serialize Id = row_number(1000000)\r\n| join kind=inner (appData) on OperationName\r\n| project Id, Name = initiator, Type = 'initiator', ['Operations Count'] = TotalCount, Trend, Category, ParentId = Id1\r\n| union (appData \r\n | project Id, Name = OperationName, Type = 'Operation', ['Operations Count'] = TotalCount, Category, Trend)\r\n| order by ['Operations Count'] desc, Name asc", "size": 0, "showAnalytics": true, "title": "Azure Activities", "timeContextFromParameter": "TimeRange", "exportParameterName": "UserInfo", "exportDefaultValue": "{ \"Name\":\"\", \"Type\":\"*\"}", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Id", "formatter": 5, "formatOptions": { "showIcon": true } }, { "columnMatch": "Type", "formatter": 5, "formatOptions": { "showIcon": true } }, { "columnMatch": "Operations Count", "formatter": 8, "formatOptions": { "min": 0, "palette": "blue", "showIcon": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "min": 0, "palette": "turquoise", "showIcon": true }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "ParentId", "formatter": 5, "formatOptions": { "showIcon": true } } ], "rowLimit": 1000, "filter": true, "hierarchySettings": { "idColumn": "Id", "parentColumn": "ParentId", "treeType": 0, "expanderColumn": "Name" } }, "sortBy": [], "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results65", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results65" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where Caller in ({UserPrincipalName})\r\n| summarize Count = count() by ResourceGroup\r\n| join kind = fullouter (datatable(ResourceGroup:string)['Medium', 'high', 'low']) on ResourceGroup\r\n| project ResourceGroup = iff(ResourceGroup == '', ResourceGroup1, ResourceGroup), Count = iff(ResourceGroup == '', 0, Count)\r\n| join kind = inner (AzureActivity\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ResourceGroup)\r\n on ResourceGroup\r\n| project-away ResourceGroup1, TimeGenerated\r\n| extend ResourceGroups = ResourceGroup\r\n| union (\r\n AzureActivity\r\n | summarize Count = count() \r\n | extend jkey = 1\r\n | join kind=inner (AzureActivity\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n | extend jkey = 1) on jkey\r\n | extend ResourceGroup = 'All', ResourceGroups = '*' \r\n)\r\n| order by Count desc\r\n| take 10", "size": 4, "showAnalytics": true, "title": "User Top 10 Resource Groups Accessed", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "ResourceGroup", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto", "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "blueOrange", "showIcon": true } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "conditionalVisibility": { "parameterName": "Results66", "comparison": "isEqualTo", "value": "Yes" }, "showPin": false, "name": "Results66" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"microsoft.insights/workbooks/write\", \"microsoft.insights/workbooks/delete\"]);\r\n// Microsoft Sentinel Workbook Create / Update / Delete\r\nAzureActivity\r\n| where Caller in ({UserPrincipalName})\r\n| where Category == \"Administrative\"\r\n| where OperationNameValue in (opValues)\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| summarize count() by Caller, ResourceId\r\n| limit 250\r\n| sort by count_ desc\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Microsoft Sentinel Workbooks Administrative Operations", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Caller", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results67", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results67", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where Caller in ({UserPrincipalName})\r\n| where OperationName == \"List Storage Account Keys\"\r\n| where ActivityStatus == \"Succeeded\" \r\n| join kind= inner (\r\n AzureActivity\r\n | where OperationName == \"List Storage Account Keys\"\r\n | where ActivityStatus == \"Succeeded\" \r\n | project ExpectedIpAddress=CallerIpAddress, Caller \r\n | evaluate autocluster()\r\n )\r\n on Caller \r\n| where Caller in ({UserPrincipalName})\r\n| summarize count() by Caller, ResourceId\r\n| limit 250\r\n| sort by count_ desc\r\n", "size": 0, "showAnalytics": true, "title": "Azure Storage Key Enumeration", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Caller", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results68", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results68", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.SecurityInsights/alertRules/write\", \"Microsoft.SecurityInsights/alertRules/delete\"]);\r\n// Microsoft Sentinel Analytics - Rule Create / Update / Delete\r\nAzureActivity\r\n| where Caller in ({UserPrincipalName})\r\n| where Category == \"Administrative\"\r\n| where OperationNameValue in (opValues)\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| where Caller in ({UserPrincipalName})\r\n| summarize count() by Caller\r\n| sort by count_ desc\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Microsoft Sentinel Analytics Rules Administrative Operations", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Caller", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ] }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results69", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results69", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where Caller in ({UserPrincipalName})\r\n| where OperationName == \"Create or Update Virtual Machine\" or OperationName == \"Create Deployment\" \r\n| where ActivityStatus == \"Succeeded\" \r\n| project Resource, ResourceGroup, Caller\r\n| evaluate basket()\r\n| where Percent <= 30\r\n| where Caller <> \"\"\r\n| summarize count() by Caller, Resource, ResourceGroup, Percent\r\n| sort by count_ desc\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Uncommonly Deployed Resources", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Caller", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "Percent", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ] }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results70", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results70", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where Caller in ({UserPrincipalName})\r\n| where OperationName == \"Create role assignment\"\r\n| where ActivityStatus == \"Succeeded\" \r\n| project Caller, CallerIpAddress\r\n| evaluate basket()\r\n| join kind=leftouter (AzureActivity\r\n | where OperationName == \"Create role assignment\"\r\n | where ActivityStatus == \"Succeeded\")\r\n on Caller, CallerIpAddress\r\n| where Caller in ({UserPrincipalName})\r\n| summarize count() by Caller, ResourceId\r\n| limit 250\r\n| sort by count_ desc\r\n", "size": 0, "showAnalytics": true, "title": "Granting Permissions to Account", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Caller", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results71", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results71", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.SecurityInsights/dataConnectors/write\", \"Microsoft.SecurityInsights/dataConnectors/delete\"]);\r\n// Microsoft Sentinel Data Connectors Update / Delete\r\nAzureActivity\r\n| where Caller in ({UserPrincipalName})\r\n| where Category == \"Administrative\"\r\n| where OperationNameValue in (opValues)\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| where Caller in ({UserPrincipalName})\r\n| summarize count() by Caller, ResourceId\r\n| limit 250\r\n| sort by count_ desc\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Microsoft Sentinel Connectors Administrative Operations", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Caller", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results72", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results72", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where Caller in ({UserPrincipalName})\r\n| where OperationName has_any (\"Create\", \"Update\") and OperationName has_any (\"Ip\", \"Security Rule\")\r\n// Choosing Accepted here because it has the Rule Attributes included\r\n| where ActivityStatus == \"Accepted\" \r\n// If there is publicIP info, include it\r\n| extend publicIPAddress_ = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).ipAddress) \r\n| extend publicIPAddressVersion_ = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).publicIPAddressVersion) \r\n| extend publicIPAllocationMethod_ = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).publicIPAllocationMethod) \r\n// Include rule attributes for context\r\n| extend access = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).access) \r\n| extend description = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).description) \r\n| extend destinationPortRange = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).destinationPortRange) \r\n| extend direction = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).direction) \r\n| extend protocol = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).protocol) \r\n| extend sourcePortRange = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).sourcePortRange) \r\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), ResourceIds = makeset(ResourceId)\r\n by Caller, CallerIpAddress, Resource, ResourceGroup, \r\n ActivityStatus, ActivitySubstatus, SubscriptionId, access, description, destinationPortRange, direction, protocol, sourcePortRange \r\n| where Caller in ({UserPrincipalName})\r\n| distinct Caller, Resource, destinationPortRange, direction, protocol, sourcePortRange, StartTime\r\n| sort by StartTime desc\r\n| limit 250\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Opening Network Ports for an Azure Resource ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Caller", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results73", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results73", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where Caller in ({UserPrincipalName})\r\n| where ResourceGroup has \"cloud-shell-storage\"\r\n| summarize count() by Caller, OperationNameValue, ResourceId\r\n| sort by count_ desc\r\n| limit 250 \r\n\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Azure Cloud Shell Usage", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Caller", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results74", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results74", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.Network/networkSecurityGroups/write\", \"Microsoft.Network/networkSecurityGroups/delete\"]);\r\n// Azure NSG Create / Update / Delete\r\nAzureActivity\r\n| where Caller in ({UserPrincipalName})\r\n| where Category == \"Administrative\"\r\n| where OperationNameValue in (opValues)\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| summarize count() by Caller, OperationNameValue, ResourceId\r\n| sort by count_ desc\r\n| limit 250 \r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Network Security Group Operations ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Caller", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results75", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results75", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where Caller in ({UserPrincipalName})\r\n| where OperationName == \"Create or Update Virtual Machine\" or OperationName == \"Create Deployment\" \r\n| where ActivityStatus == \"Succeeded\" \r\n| summarize count() by Caller, ResourceId\r\n| sort by count_ desc\r\n", "size": 0, "showAnalytics": true, "title": "Creation of an Anomalous Number of Resources", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Caller", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results76", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results76", "styleSettings": { "maxWidth": "50" } } ] }, "conditionalVisibility": { "parameterName": "isAzureActivityVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Azure Activity Group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "7afa304d-b448-4d6c-8c54-69e51a7249a9", "version": "KqlParameterItem/1.0", "name": "Results79", "type": 1, "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results79", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "2a891328-fdea-48e1-9363-99fc0ac0468c", "version": "KqlParameterItem/1.0", "name": "Results80", "type": 1, "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where Operation contains \"file\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results80", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "0055a8c6-412d-4862-a000-a9026c29d0d4", "version": "KqlParameterItem/1.0", "name": "Results81", "type": 1, "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where OfficeWorkload == \"MicrosoftTeams\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results81", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "2dc10ed4-b880-4c42-811b-f361c470bea7", "version": "KqlParameterItem/1.0", "name": "Results82", "type": 1, "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where OfficeWorkload == \"Exchange\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results82", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "ebc6e154-835c-4dc9-9142-e84e21a723e3", "version": "KqlParameterItem/1.0", "name": "Results83", "type": 1, "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where ExternalAccess <> \"True\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results83", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "c7050e45-04ed-43d1-9af8-e7ba591349f0", "version": "KqlParameterItem/1.0", "name": "Results84", "type": 1, "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where OfficeWorkload =~ \"MicrosoftTeams\"\r\n| where Operation =~ \"BotAddedToTeam\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results84", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "0d5b45d1-3217-43e6-affd-56b73e7d3560", "version": "KqlParameterItem/1.0", "name": "Results85", "type": 1, "query": "let starttime = {TimeRange:grain};\r\nlet endtime = 1d;\r\nlet historicalActivity=\r\n OfficeActivity\r\n | where TimeGenerated between(ago(starttime)..ago(endtime))\r\n | where RecordType == \"ExchangeAdmin\" and UserType in (\"Admin\", \"DcAdmin\")\r\n | summarize historicalCount=count() by UserId;\r\nlet recentActivity = OfficeActivity\r\n | where UserId in ({UserPrincipalName})\r\n | where TimeGenerated > ago(endtime)\r\n | where UserType in (\"Admin\", \"DcAdmin\")\r\n | summarize recentCount=count() by UserId;\r\nrecentActivity\r\n| join kind = leftanti (\r\n historicalActivity\r\n )\r\n on UserId\r\n| project UserId, recentCount\r\n| order by recentCount asc, UserId\r\n| join kind = rightsemi \r\n (OfficeActivity \r\n | where TimeGenerated >= ago(endtime) \r\n | where RecordType == \"ExchangeAdmin\"\r\n | where UserType in (\"Admin\", \"DcAdmin\")) \r\n on UserId\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results85", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "fd74a8c1-4044-49f4-82de-b2653dc51d7c", "version": "KqlParameterItem/1.0", "name": "Results86", "type": 1, "query": "let starttime = {TimeRange:grain};\r\nlet endtime = 1d;\r\nlet historicalActivity=\r\n OfficeActivity\r\n | where RecordType == \"SharePointFileOperation\"\r\n | where Operation in (\"FileDownloaded\", \"FileUploaded\")\r\n | where TimeGenerated between(ago(starttime)..ago(endtime))\r\n | summarize historicalCount=count() by ClientIP;\r\nlet recentActivity = OfficeActivity\r\n | where UserId in ({UserPrincipalName})\r\n | where RecordType == \"SharePointFileOperation\"\r\n | where Operation in (\"FileDownloaded\", \"FileUploaded\")\r\n | where TimeGenerated > ago(endtime);\r\nrecentActivity\r\n| join kind= leftanti (\r\n historicalActivity \r\n )\r\n on ClientIP \r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results86", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "b5149369-531f-4db9-b16d-ae6af2af2ce6", "version": "KqlParameterItem/1.0", "name": "Results87", "type": 1, "query": "let starttime = {TimeRange:grain};\r\nlet endtime = 1d;\r\nlet historicalActivity=\r\n OfficeActivity\r\n | where RecordType == \"SharePointFileOperation\"\r\n | where Operation in (\"FileDownloaded\", \"FileUploaded\")\r\n | where TimeGenerated between(ago(starttime)..ago(endtime))\r\n | summarize historicalCount=count() by UserAgent, RecordType;\r\nlet recentActivity = OfficeActivity\r\n | where UserId in ({UserPrincipalName})\r\n | where RecordType == \"SharePointFileOperation\"\r\n | where Operation in (\"FileDownloaded\", \"FileUploaded\")\r\n | where TimeGenerated > ago(endtime);\r\nrecentActivity\r\n| join kind = leftanti (\r\n historicalActivity \r\n )\r\n on UserAgent, RecordType\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results87", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "64a696b7-19fc-4cd6-a0fb-6b8d943868dc", "version": "KqlParameterItem/1.0", "name": "Results88", "type": 1, "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where Operation == \"MailboxLogin\" and Logon_Type != \"Owner\" \r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results88", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "57c00f66-6a47-4179-be44-c07b1f0f7ff1", "version": "KqlParameterItem/1.0", "name": "Results89", "type": 1, "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where Operation == \"MailboxLogin\"\r\n| where ClientInfoString == \"Client=Microsoft.Exchange.Powershell; Microsoft WinRM Client\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results89", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "a6eb5e71-9e0f-46f7-891c-11ac8b8f03cd", "version": "KqlParameterItem/1.0", "name": "Results90", "type": 1, "query": "// Adjust this value to change how many Teams should be deleted before including\r\nlet max_delete = 3;\r\nlet deleting_users = (\r\n OfficeActivity\r\n | where UserId in ({UserPrincipalName})\r\n | where OfficeWorkload =~ \"MicrosoftTeams\"\r\n | where Operation =~ \"TeamDeleted\"\r\n | summarize count() by UserId\r\n | where count_ > max_delete\r\n | project UserId);\r\nOfficeActivity\r\n| where OfficeWorkload =~ \"MicrosoftTeams\"\r\n| where Operation =~ \"TeamDeleted\"\r\n| where UserId in (deleting_users)\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results90", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "c9283cec-012f-4e89-917b-4ebfea0d4c9c", "version": "KqlParameterItem/1.0", "name": "Results91", "type": 1, "query": "let threshold = 1m;\r\nOfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where OfficeWorkload =~ \"MicrosoftTeams\"\r\n| where Operation == \"MemberAdded\"\r\n| extend TeamName = iff(isempty(TeamName), Members[0].UPN, TeamName)\r\n| project TimeGenerated, UserId, UploaderID=UserId, TeamName\r\n| join (\r\n OfficeActivity\r\n | where RecordType == \"SharePointFileOperation\"\r\n | where SourceRelativeUrl has \"Microsoft Teams Chat Files\"\r\n | where Operation == \"FileUploaded\"\r\n | project UserId, UploadTime=TimeGenerated, UploaderID=UserId, FileLocation=OfficeObjectId, FileName=SourceFileName\r\n )\r\n on UploaderID\r\n| where UploadTime > TimeGenerated and UploadTime < TimeGenerated + threshold\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results91", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "045e5099-2b58-4af1-8525-5620752bed66", "version": "KqlParameterItem/1.0", "name": "Results92", "type": 1, "query": "let known_ext = dynamic([\"lnk\", \"log\", \"option\", \"config\", \"manifest\", \"partial\"]);\r\nlet excluded_users = dynamic([\"app@sharepoint\"]);\r\nOfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where RecordType =~ \"SharePointFileOperation\" and isnotempty(SourceFileName)\r\n| where OfficeObjectId has \".exe.\" and SourceFileExtension !in~ (known_ext)\r\n| extend Extension = extract(\"[^.]*.[^.]*$\", 0, OfficeObjectId)\r\n| join kind= leftouter ( \r\n OfficeActivity\r\n | where RecordType =~ \"SharePointFileOperation\" and (Operation =~ \"FileDownloaded\" or Operation =~ \"FileAccessed\") \r\n | where SourceFileExtension !in~ (known_ext)\r\n )\r\n on OfficeObjectId \r\n| where UserId1 !in~ (excluded_users)\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results92", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "fb33950d-7f2b-4304-b688-9cb0e103f6dc", "version": "KqlParameterItem/1.0", "name": "Results93", "type": 1, "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where OfficeWorkload == \"Exchange\"\r\n| where Operation in~ (\"New-TransportRule\", \"Set-TransportRule\")\r\n| extend p = parse_json(Parameters)\r\n| extend RuleName = case(\r\n Operation =~ \"Set-TransportRule\", tostring(OfficeObjectId),\r\n Operation =~ \"New-TransportRule\", tostring(p[1].Value),\r\n \"Unknown\"\r\n ) \r\n| mvexpand p\r\n| where (p.Name =~ \"BlindCopyTo\" or p.Name =~ \"RedirectMessageTo\") and isnotempty(p.Value)\r\n| extend RedirectTo = p.Value\r\n| extend ClientIPOnly = case( \r\n ClientIP has \".\" and ClientIP has \":\", tostring(split(ClientIP, \":\")[0]), \r\n ClientIP has \".\" and ClientIP has \"-\", tostring(split(ClientIP, \"-\")[0]), \r\n ClientIP has \"[\", tostring(trim_start(@'[[]', tostring(split(ClientIP, \"]\")[0]))),\r\n ClientIP\r\n ) \r\n| extend Port = case(\r\n ClientIP has \".\" and ClientIP has \":\", (split(ClientIP, \":\")[1]),\r\n ClientIP has \".\" and ClientIP has \"-\", (split(ClientIP, \"-\")[1]),\r\n ClientIP has \"[\" and ClientIP has \":\", tostring(split(ClientIP, \"]:\")[1]),\r\n ClientIP has \"[\" and ClientIP has \"-\", tostring(split(ClientIP, \"]-\")[1]),\r\n ClientIP\r\n )\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results93", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "dc33037c-0615-4f66-98b8-35e450068f1e", "version": "KqlParameterItem/1.0", "name": "Results94", "type": 1, "query": "// a threshold can be enabled, see commented line below for PrevSeenCount\r\nlet threshold = 1;\r\n// Reserved FileNames/Extension for Windows\r\nlet Reserved = dynamic(['CON', 'PRN', 'AUX', 'NUL', 'COM1', 'COM2', 'COM3', 'COM4', 'COM5', 'COM6', 'COM7', 'COM8', 'COM9', 'LPT1', 'LPT2', 'LPT3', 'LPT4', 'LPT5', 'LPT6', 'LPT7', 'LPT8', 'LPT9']);\r\nlet starttime = {TimeRange:grain};\r\nlet endtime = 1d;\r\nOfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where TimeGenerated >= ago(endtime)\r\n| where isnotempty(SourceFileExtension)\r\n| where SourceFileName !~ SourceFileExtension\r\n| where SourceFileExtension in~ (Reserved) or SourceFileName in~ (Reserved)\r\n| where UserAgent !has \"Mac OS\" \r\n| project TimeGenerated, OfficeId, OfficeWorkload, RecordType, Operation, UserType, UserKey, UserId, ClientIP, UserAgent, Site_Url, SourceRelativeUrl, SourceFileName, SourceFileExtension \r\n| join kind= leftanti (\r\n OfficeActivity\r\n | where TimeGenerated between (ago(starttime)..ago(endtime))\r\n | where isnotempty(SourceFileExtension)\r\n | where SourceFileName !~ SourceFileExtension\r\n | where SourceFileExtension in~ (Reserved) or SourceFileName in~ (Reserved)\r\n | where UserAgent !has \"Mac OS\" \r\n | summarize SourceRelativeUrl = make_set(SourceRelativeUrl), UserId = make_set(UserId), SourceFileName = make_set(SourceFileName), PrevSeenCount = count() by SourceFileExtension\r\n // To exclude previous matches when only above a specific count, change threshold above and uncomment the line below\r\n //| where PrevSeenCount > threshold\r\n | mvexpand SourceRelativeUrl, UserId, SourceFileName\r\n | extend SourceRelativeUrl = tostring(SourceRelativeUrl), UserId = tostring(UserId), SourceFileName = tostring(SourceFileName)\r\n )\r\n on SourceFileExtension\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results94", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "3d9de6bf-6bf9-42dd-9ed5-9e03ee5e48af", "version": "KqlParameterItem/1.0", "name": "Results95", "type": 1, "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where (Operation =~ \"Set-Mailbox\" and Parameters contains 'ForwardingSmtpAddress') \r\n or (Operation =~ 'New-InboxRule' and Parameters contains 'ForwardTo')\r\n| extend parsed=parse_json(Parameters)\r\n| extend fwdingDestination_initial = (iif(Operation =~ \"Set-Mailbox\", tostring(parsed[1].Value), tostring(parsed[2].Value)))\r\n| where isnotempty(fwdingDestination_initial)\r\n| extend fwdingDestination = iff(fwdingDestination_initial has \"smtp\", (split(fwdingDestination_initial, \":\")[1]), fwdingDestination_initial)\r\n| parse fwdingDestination with * '@' ForwardedtoDomain \r\n| parse UserId with *'@' UserDomain\r\n| extend subDomain = ((split(strcat(tostring(split(UserDomain, '.')[-2]), '.', tostring(split(UserDomain, '.')[-1])), '.')[0]))\r\n| where ForwardedtoDomain !contains subDomain\r\n| extend Result = iff(ForwardedtoDomain != UserDomain, \"Mailbox rule created to forward to External Domain\", \"Forward rule for Internal domain\")\r\n| extend ClientIPAddress = case(ClientIP has \".\", tostring(split(ClientIP, \":\")[0]), ClientIP has \"[\", tostring(trim_start(@'[[]', tostring(split(ClientIP, \"]\")[0]))), ClientIP)\r\n| extend Port = case(\r\n ClientIP has \".\", (split(ClientIP, \":\")[1]),\r\n ClientIP has \"[\", tostring(split(ClientIP, \"]:\")[1]),\r\n ClientIP\r\n )\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results95", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "5a4b34c2-c933-4255-a151-6781fc58aa9b", "version": "KqlParameterItem/1.0", "name": "Results96", "type": 1, "query": "OfficeActivity \r\n| where UserId in ({UserPrincipalName})\r\n| where RecordType =~ \"SharePointFileOperation\"\r\n| where Operation =~ \"FileUploaded\" \r\n| where UserId != \"app@sharepoint\"\r\n| where SourceRelativeUrl has \"Microsoft Teams Chat Files\" \r\n| join kind= leftouter ( \r\n OfficeActivity \r\n | where RecordType =~ \"SharePointFileOperation\"\r\n | where Operation =~ \"FileDownloaded\" or Operation =~ \"FileAccessed\" \r\n | where UserId != \"app@sharepoint\"\r\n | where SourceRelativeUrl has \"Microsoft Teams Chat Files\" \r\n )\r\n on OfficeObjectId \r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results96", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "2ef18052-f3a2-4c9b-8f79-c4805018680d", "version": "KqlParameterItem/1.0", "name": "Results97", "type": 1, "query": "// Reserved FileNames/Extension for Windows\r\nlet Reserved = dynamic(['CON', 'PRN', 'AUX', 'NUL', 'COM1', 'COM2', 'COM3', 'COM4', 'COM5', 'COM6', 'COM7', 'COM8', 'COM9', 'LPT1', 'LPT2', 'LPT3', 'LPT4', 'LPT5', 'LPT6', 'LPT7', 'LPT8', 'LPT9']);\r\nOfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where isnotempty(SourceFileExtension)\r\n| where SourceFileExtension in~ (Reserved) or SourceFileName in~ (Reserved)\r\n| where UserAgent !has \"Mac OS\" \r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results97", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "e3a6793b-d24b-4e69-922a-6bce21138d10", "version": "KqlParameterItem/1.0", "name": "Results98", "type": 1, "query": "// Adjust this value to change how many teams a user is made owner of before detecting\r\nlet max_owner_count = 3;\r\n// Change this value to adjust how larger timeframe the query is run over.\r\nlet high_owner_count = (OfficeActivity\r\n | where OfficeWorkload =~ \"MicrosoftTeams\"\r\n | where Operation =~ \"MemberRoleChanged\"\r\n | extend Member = tostring(parse_json(Members)[0].UPN) \r\n | extend NewRole = toint(parse_json(Members)[0].Role) \r\n | where NewRole == 2\r\n | summarize dcount(TeamName) by Member\r\n | where dcount_TeamName > max_owner_count\r\n | project Member);\r\nOfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where OfficeWorkload =~ \"MicrosoftTeams\"\r\n| where Operation =~ \"MemberRoleChanged\"\r\n| extend Member = tostring(parse_json(Members)[0].UPN) \r\n| extend NewRole = toint(parse_json(Members)[0].Role) \r\n| where NewRole == 2\r\n| where Member in (high_owner_count)\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results98", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "982af542-16a2-429f-9414-2de706b1daf8", "version": "KqlParameterItem/1.0", "name": "Results99", "type": 1, "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where UserType in~ (\"Admin\",\"DcAdmin\") \r\n// Only admin or global-admin can disable audit logging\r\n| where Operation =~ \"Set-AdminAuditLogConfig\" \r\n| extend AdminAuditLogEnabledValue = tostring(parse_json(tostring(parse_json(tostring(array_slice(parse_json(Parameters),3,3)))[0])).Value)\r\n| where AdminAuditLogEnabledValue =~ \"False\" \r\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() by Operation, UserType, UserId, ClientIP, ResultStatus, Parameters, AdminAuditLogEnabledValue\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results99", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "c385b319-e2bb-48de-ac7b-2456aa884b60", "version": "KqlParameterItem/1.0", "name": "Results100", "type": 1, "query": "//Add Keywords for Emails as needed\r\nlet Keywords = dynamic([\"helpdesk\", \" alert\", \" suspicious\", \"fake\", \"malicious\", \"phishing\", \"spam\", \"do not click\", \"do not open\", \"hijacked\", \"Fatal\"]);\r\nOfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where Operation =~ \"New-InboxRule\"\r\n| where Parameters has \"Deleted Items\" or Parameters has \"Junk Email\" \r\n| extend Events=todynamic(Parameters)\r\n| parse Events with * \"SubjectContainsWords\" SubjectContainsWords '}'*\r\n| parse Events with * \"BodyContainsWords\" BodyContainsWords '}'*\r\n| parse Events with * \"SubjectOrBodyContainsWords\" SubjectOrBodyContainsWords '}'*\r\n| where SubjectContainsWords has_any (Keywords)\r\n or BodyContainsWords has_any (Keywords)\r\n or SubjectOrBodyContainsWords has_any (Keywords)\r\n| extend ClientIPAddress = case( ClientIP has \".\", tostring(split(ClientIP,\":\")[0]), ClientIP has \"[\", tostring(trim_start(@'[[]',tostring(split(ClientIP,\"]\")[0]))), ClientIP )\r\n| extend Keyword = iff(isnotempty(SubjectContainsWords), SubjectContainsWords, (iff(isnotempty(BodyContainsWords),BodyContainsWords,SubjectOrBodyContainsWords )))\r\n| extend RuleDetail = case(OfficeObjectId contains '/' , tostring(split(OfficeObjectId, '/')[-1]) , tostring(split(OfficeObjectId, '\\\\')[-1]))\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "10", "name": "Results100" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "776847fb-789e-45e6-a314-7cfed84e4f03", "version": "KqlParameterItem/1.0", "name": "Results101", "type": 1, "query": "let opList = OfficeActivity \r\n| where UserId in ({UserPrincipalName})\r\n| summarize by Operation\r\n//| where Operation startswith \"Remove-\" or Operation startswith \"Disable-\"\r\n| where Operation has_any (\"Remove\", \"Disable\")\r\n| where Operation contains \"AntiPhish\" or Operation contains \"SafeAttachment\" or Operation contains \"SafeLinks\" or Operation contains \"Dlp\" or Operation contains \"Audit\"\r\n| summarize make_set(Operation);\r\nOfficeActivity\r\n// Only admin or global-admin can disable/remove policy\r\n| where RecordType =~ \"ExchangeAdmin\"\r\n| where UserType in~ (\"Admin\",\"DcAdmin\")\r\n// Pass in interesting Operation list\r\n| where Operation in~ (opList)\r\n| extend ClientIPOnly = case( \r\nClientIP has \".\", tostring(split(ClientIP,\":\")[0]), \r\nClientIP has \"[\", tostring(trim_start(@'[[]',tostring(split(ClientIP,\"]\")[0]))),\r\nClientIP\r\n) \r\n| extend Port = case(\r\nClientIP has \".\", (split(ClientIP,\":\")[1]),\r\nClientIP has \"[\", tostring(split(ClientIP,\"]:\")[1]),\r\nClientIP\r\n)\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "25", "name": "Results101", "styleSettings": { "maxWidth": "25" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "0d3daf9a-eee1-4ae9-818e-5026a178b20a", "version": "KqlParameterItem/1.0", "name": "Results808", "type": 1, "query": "EmailEvents\r\n| where RecipientEmailAddress in ({UserPrincipalName}) or SenderMailFromAddress in ({UserPrincipalName}) \r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "40", "name": "Results808" }, { "type": 1, "content": { "json": "# [Microsoft 365 Activity](https://docs.microsoft.com/azure/sentinel/connect-microsoft-365-defender)\n---\n\nMicrosoft Sentinel's Microsoft Defender XDR (MDXDR) connector with incident integration allows you to stream all incidents and alerts into Microsoft Sentinel, and keeps the incidents synchronized between both portals. MDXDR incidents include all their alerts, entities, and other relevant information, and they are enriched by and group together alerts from MDXDR's component services Microsoft Defender for Endpoint, Microsoft Defender for Identity, Microsoft Defender for Office 365, and Microsoft Defender for Cloud Apps.\n\n\n\n" }, "customWidth": "40", "name": "text - 2" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 56" }, { "type": 1, "content": { "json": "| Office Activity Queries | - | - | \r\n|:--| :--| :--|\r\n| Office Activity Over Time | Office Activity Count by Workload |Office Activity Count By Workload |\r\n| File Activity Actions |File Activity Actions over Time |File Access Activity Details |\r\n| Most Frequently Accessed Files |Microsoft Teams Activity |Microsoft Teams Activity over Time |\r\n| Exchange Activity |Exchange Activity over Time |Exchange Activity Details |\r\n| Externally Accessing Office Workloads |Added Bots to Teams |New Admin Activity |\r\n| SharePointFileOperation from New IP |SharePointFileOperation via New User Agent |Non-Owner Mailbox Login Activity |\r\n| PowerShell or Non-Browser Mailbox Sign-In Activity |Multiple Teams Deleted | User Added to Team and Immediately Uploads File |\r\n| Executable with Double File Extension and Access Summary |Mail Redirect via Exchange Transport Rules |Files Uploaded to Teams and Access Summary |\r\n| Windows Reserved Filenames Staged on Office File Services |User Added as Owner of Multiple Teams |Exchange AuditLog Disabled |\r\n| Malicious Inbox Rule: Removing Helpdesk/Security Warning Emails | Office Policy Tampering \r\n\r\nThis section is bound by the above parameters for Subscription, Workspace, TimeRange, and User. Panels are dynamically displayed meaning numerous queries are executed and only panels returning data are displayed. \r\n" }, "customWidth": "40", "name": "SI OV" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by OfficeWorkload\r\n| render timechart\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Office Activity Over Time", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "75", "conditionalVisibility": { "parameterName": "Results79", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results79" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| summarize count() by OfficeWorkload\r\n| render piechart\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Office Activity Count by Workload", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "25", "conditionalVisibility": { "parameterName": "Results79", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results79b" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| summarize count() by UserId, Operation, OfficeWorkload\r\n| sort by count_ desc\r\n| limit 250\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Office Activity Count By Workload", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "pending", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "blue" } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results79", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results79c", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where Operation contains \"file\"\r\n| extend Path = OfficeObjectId\r\n| summarize count() by UserId, Operation\r\n| sort by count_ desc\r\n| limit 250\r\n\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "File Activity Actions", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results80", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results80", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where Operation contains \"file\"\r\n| extend Path = OfficeObjectId\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by Operation\r\n| render timechart\r\n\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "File Activity Actions over Time", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results80", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results80b", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where Operation contains \"file\"\r\n| extend Path = OfficeObjectId\r\n| project UserId, UserType, OfficeWorkload, Operation, SourceFileName, SourceFileExtension, Path, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "File Access Activity Details", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results80", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results80c", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where Operation contains \"file\"\r\n| summarize count() by UserId, SourceFileName, SourceFileExtension, OfficeObjectId \r\n| sort by count_ desc\r\n| limit 250\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Most Frequently Accessed Files", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "SourceFileName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "info", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeObjectId", "formatter": 7, "formatOptions": { "linkTarget": "Url" } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "conditionalVisibility": { "parameterName": "Results80", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results80d" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where OfficeWorkload == \"MicrosoftTeams\"\r\n| summarize count() by UserId, Operation\r\n| sort by count_ desc\r\n| limit 250\r\n\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Microsoft Teams Activity", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results81", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results81", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where OfficeWorkload == \"MicrosoftTeams\"\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by Operation\r\n| render timechart\r\n\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Microsoft Teams Activity over Time", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results81", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results81b", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where OfficeWorkload == \"Exchange\"\r\n| summarize count() by UserId, Operation\r\n| sort by count_ desc\r\n| limit 250\r\n\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Exchange Activity", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results82", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results82", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where OfficeWorkload == \"Exchange\"\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by Operation\r\n| render timechart\r\n\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Exchange Activity over Time", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results82", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results82b", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where OfficeWorkload == \"Exchange\"\r\n| project UserId, UserType, Logon_Type, Operation, Folders, TimeGenerated\r\n| limit 250\r\n\r\n\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Exchange Activity Details", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ], "filter": true, "sortBy": [ { "itemKey": "Folders", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "Folders", "sortOrder": 2 } ], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results82", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results82c", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where ExternalAccess <> \"True\"\r\n| summarize count() by UserId\r\n| sort by count_ desc\r\n| limit 250\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Externally Accessing Office Workloads", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results83", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results83", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where OfficeWorkload =~ \"MicrosoftTeams\"\r\n| where Operation =~ \"BotAddedToTeam\"\r\n| summarize count() by UserId, TimeGenerated\r\n| sort by count_ desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Added Bots to Teams", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results84", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results84", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let starttime = {TimeRange:grain};\r\nlet endtime = 1d;\r\nlet historicalActivity=\r\n OfficeActivity\r\n | where TimeGenerated between(ago(starttime)..ago(endtime))\r\n | where RecordType == \"ExchangeAdmin\" \r\n | summarize historicalCount=count() by UserId;\r\nlet recentActivity = OfficeActivity\r\n | where UserId in ({UserPrincipalName})\r\n | where TimeGenerated > ago(endtime)\r\n | summarize recentCount=count() by UserId;\r\nrecentActivity\r\n| join kind = leftanti (\r\n historicalActivity\r\n )\r\n on UserId\r\n| project UserId, recentCount\r\n| order by recentCount asc, UserId\r\n| join kind = rightsemi \r\n (OfficeActivity \r\n | where TimeGenerated >= ago(endtime) \r\n | where RecordType == \"ExchangeAdmin\")\r\n on UserId\r\n| summarize StartTime = max(TimeGenerated), EndTime = min(TimeGenerated), count() by RecordType, Operation, UserType, UserId, OriginatingServer, ResultStatus\r\n| summarize count() by UserId\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Administrator Activity Not Observed Previously", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results85", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results85", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let starttime = {TimeRange:grain};\r\nlet endtime = 1d;\r\nlet historicalActivity=\r\n OfficeActivity\r\n | where RecordType == \"SharePointFileOperation\"\r\n | where Operation in (\"FileDownloaded\", \"FileUploaded\")\r\n | where TimeGenerated between(ago(starttime)..ago(endtime))\r\n | summarize historicalCount=count() by ClientIP;\r\nlet recentActivity = OfficeActivity\r\n | where UserId in ({UserPrincipalName})\r\n | where RecordType == \"SharePointFileOperation\"\r\n | where Operation in (\"FileDownloaded\", \"FileUploaded\")\r\n | where TimeGenerated > ago(endtime);\r\nrecentActivity\r\n| join kind= leftanti (\r\n historicalActivity \r\n )\r\n on ClientIP \r\n| summarize count() by UserId\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "SharePointFileOperation via Previously Unseen IPs", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results86", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results86", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let starttime = {TimeRange:grain};\r\nlet endtime = 1d;\r\nlet historicalActivity=\r\n OfficeActivity\r\n | where RecordType == \"SharePointFileOperation\"\r\n | where Operation in (\"FileDownloaded\", \"FileUploaded\")\r\n | where TimeGenerated between(ago(starttime)..ago(endtime))\r\n | summarize historicalCount=count() by UserAgent, RecordType;\r\nlet recentActivity = OfficeActivity\r\n | where UserId in ({UserPrincipalName})\r\n | where RecordType == \"SharePointFileOperation\"\r\n | where Operation in (\"FileDownloaded\", \"FileUploaded\")\r\n | where TimeGenerated > ago(endtime);\r\nrecentActivity\r\n| join kind = leftanti (\r\n historicalActivity \r\n )\r\n on UserAgent, RecordType\r\n| summarize count() by UserId\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "SharePointFileOperation via Devices with Previously Unseen User Agents", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results87", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results87", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where Operation == \"MailboxLogin\" and Logon_Type != \"Owner\" \r\n| summarize count() by UserId\r\n| sort by count_ desc\r\n", "size": 0, "showAnalytics": true, "title": "Non-Owner Mailbox Login Activity", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results88", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results88", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where Operation == \"MailboxLogin\"\r\n| where ClientInfoString == \"Client=Microsoft.Exchange.Powershell; Microsoft WinRM Client\"\r\n| summarize count() by UserId\r\n| sort by count_ desc\r\n", "size": 0, "showAnalytics": true, "title": "PowerShell or Non-Browser Mailbox Sign-In Activity", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results89", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results89", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Adjust this value to change how many Teams should be deleted before including\r\nlet max_delete = 3;\r\nlet deleting_users = (\r\n OfficeActivity\r\n | where UserId in ({UserPrincipalName})\r\n | where OfficeWorkload =~ \"MicrosoftTeams\"\r\n | where Operation =~ \"TeamDeleted\"\r\n | summarize count() by UserId\r\n | where count_ > max_delete\r\n | project UserId);\r\nOfficeActivity\r\n| where OfficeWorkload =~ \"MicrosoftTeams\"\r\n| where Operation =~ \"TeamDeleted\"\r\n| where UserId in (deleting_users)\r\n| summarize count() by UserId\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Multiple Teams Deleted by a Single User", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results90", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results90", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let threshold = 1m;\r\nOfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where OfficeWorkload =~ \"MicrosoftTeams\"\r\n| where Operation == \"MemberAdded\"\r\n| extend TeamName = iff(isempty(TeamName), Members[0].UPN, TeamName)\r\n| project TimeGenerated, UserId, UploaderID=UserId, TeamName\r\n| join (\r\n OfficeActivity\r\n | where RecordType == \"SharePointFileOperation\"\r\n | where SourceRelativeUrl has \"Microsoft Teams Chat Files\"\r\n | where Operation == \"FileUploaded\"\r\n | project UserId, UploadTime=TimeGenerated, UploaderID=UserId, FileLocation=OfficeObjectId, FileName=SourceFileName\r\n )\r\n on UploaderID\r\n| where UploadTime > TimeGenerated and UploadTime < TimeGenerated + threshold\r\n| summarize count() by UserId\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "User Added to Team and Immediately Uploads File", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results91", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results91", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let known_ext = dynamic([\"lnk\", \"log\", \"option\", \"config\", \"manifest\", \"partial\"]);\r\nlet excluded_users = dynamic([\"app@sharepoint\"]);\r\nOfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where RecordType =~ \"SharePointFileOperation\" and isnotempty(SourceFileName)\r\n| where OfficeObjectId has \".exe.\" and SourceFileExtension !in~ (known_ext)\r\n| extend Extension = extract(\"[^.]*.[^.]*$\", 0, OfficeObjectId)\r\n| join kind= leftouter ( \r\n OfficeActivity\r\n | where RecordType =~ \"SharePointFileOperation\" and (Operation =~ \"FileDownloaded\" or Operation =~ \"FileAccessed\") \r\n | where SourceFileExtension !in~ (known_ext)\r\n )\r\n on OfficeObjectId \r\n| where UserId1 !in~ (excluded_users)\r\n| extend userBag = pack(UserId1, ClientIP1) \r\n| summarize makeset(UserId1), make_bag(userBag), Start=max(TimeGenerated), End=min(TimeGenerated) by UserId, OfficeObjectId, SourceFileName, Extension \r\n| extend NumberOfUsers = array_length(bag_keys(bag_userBag))\r\n| project UploadTime=Start, Uploader=UserId, FileLocation=OfficeObjectId, FileName=SourceFileName, AccessedBy=bag_userBag, Extension, NumberOfUsers\r\n| extend timestamp = UploadTime, AccountCustomEntity = Uploader", "size": 0, "showAnalytics": true, "title": "Executable with Double File Extension and Acces Summary", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results92", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results92", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where OfficeWorkload == \"Exchange\"\r\n| where Operation in~ (\"New-TransportRule\", \"Set-TransportRule\")\r\n| extend p = parse_json(Parameters)\r\n| extend RuleName = case(\r\n Operation =~ \"Set-TransportRule\", tostring(OfficeObjectId),\r\n Operation =~ \"New-TransportRule\", tostring(p[1].Value),\r\n \"Unknown\"\r\n ) \r\n| mvexpand p\r\n| where (p.Name =~ \"BlindCopyTo\" or p.Name =~ \"RedirectMessageTo\") and isnotempty(p.Value)\r\n| extend RedirectTo = p.Value\r\n| extend ClientIPOnly = case( \r\n ClientIP has \".\" and ClientIP has \":\", tostring(split(ClientIP, \":\")[0]), \r\n ClientIP has \".\" and ClientIP has \"-\", tostring(split(ClientIP, \"-\")[0]), \r\n ClientIP has \"[\", tostring(trim_start(@'[[]', tostring(split(ClientIP, \"]\")[0]))),\r\n ClientIP\r\n ) \r\n| extend Port = case(\r\n ClientIP has \".\" and ClientIP has \":\", (split(ClientIP, \":\")[1]),\r\n ClientIP has \".\" and ClientIP has \"-\", (split(ClientIP, \"-\")[1]),\r\n ClientIP has \"[\" and ClientIP has \":\", tostring(split(ClientIP, \"]:\")[1]),\r\n ClientIP has \"[\" and ClientIP has \"-\", tostring(split(ClientIP, \"]-\")[1]),\r\n ClientIP\r\n )\r\n| summarize count() by UserId\r\n| sort by count_ desc\r\n", "size": 0, "showAnalytics": true, "title": "Mail Redirect via Exchange Transport Rules", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results93", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results93", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// a threshold can be enabled, see commented line below for PrevSeenCount\r\nlet threshold = 1;\r\n// Reserved FileNames/Extension for Windows\r\nlet Reserved = dynamic(['CON', 'PRN', 'AUX', 'NUL', 'COM1', 'COM2', 'COM3', 'COM4', 'COM5', 'COM6', 'COM7', 'COM8', 'COM9', 'LPT1', 'LPT2', 'LPT3', 'LPT4', 'LPT5', 'LPT6', 'LPT7', 'LPT8', 'LPT9']);\r\nlet starttime = {TimeRange:grain};\r\nlet endtime = 1d;\r\nOfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where TimeGenerated >= ago(endtime)\r\n| where isnotempty(SourceFileExtension)\r\n| where SourceFileName !~ SourceFileExtension\r\n| where SourceFileExtension in~ (Reserved) or SourceFileName in~ (Reserved)\r\n| where UserAgent !has \"Mac OS\" \r\n| project TimeGenerated, OfficeId, OfficeWorkload, RecordType, Operation, UserType, UserKey, UserId, ClientIP, UserAgent, Site_Url, SourceRelativeUrl, SourceFileName, SourceFileExtension \r\n| join kind= leftanti (\r\n OfficeActivity\r\n | where TimeGenerated between (ago(starttime)..ago(endtime))\r\n | where isnotempty(SourceFileExtension)\r\n | where SourceFileName !~ SourceFileExtension\r\n | where SourceFileExtension in~ (Reserved) or SourceFileName in~ (Reserved)\r\n | where UserAgent !has \"Mac OS\" \r\n | summarize SourceRelativeUrl = make_set(SourceRelativeUrl), UserId = make_set(UserId), SourceFileName = make_set(SourceFileName), PrevSeenCount = count() by SourceFileExtension\r\n // To exclude previous matches when only above a specific count, change threshold above and uncomment the line below\r\n //| where PrevSeenCount > threshold\r\n | mvexpand SourceRelativeUrl, UserId, SourceFileName\r\n | extend SourceRelativeUrl = tostring(SourceRelativeUrl), UserId = tostring(UserId), SourceFileName = tostring(SourceFileName)\r\n )\r\n on SourceFileExtension\r\n| extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])\r\n| extend UserIdUserFolderFormat = tolower(replace('@|\\\\.', '_', UserId))\r\n// identify when UserId is not a match to the specific site url personal folder reference\r\n| extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false) \r\n| summarize TimeGenerated = make_list(TimeGenerated), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_list(Operation), UserAgents = make_list(UserAgent), \r\n OfficeIds = make_list(OfficeId), SourceRelativeUrls = make_list(SourceRelativeUrl), FileNames = make_list(SourceFileName)\r\n by OfficeWorkload, RecordType, UserType, UserKey, UserId, ClientIP, Site_Url, SourceFileExtension, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder\r\n| summarize count() by UserId\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Windows Reserved Filenames Staged on Office File Services", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results94", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results94", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where (Operation contains 'Forward') \r\n or (Parameters contains 'ForwardTo')\r\n| extend parsed=parse_json(Parameters)\r\n| extend fwdingDestination_initial = (iif(Operation =~ \"Set-Mailbox\", tostring(parsed[1].Value), tostring(parsed[2].Value)))\r\n| where isnotempty(fwdingDestination_initial)\r\n| extend fwdingDestination = iff(fwdingDestination_initial has \"smtp\", (split(fwdingDestination_initial, \":\")[1]), fwdingDestination_initial)\r\n| parse fwdingDestination with * '@' ForwardedtoDomain \r\n| parse UserId with *'@' UserDomain\r\n| extend subDomain = ((split(strcat(tostring(split(UserDomain, '.')[-2]), '.', tostring(split(UserDomain, '.')[-1])), '.')[0]))\r\n| where ForwardedtoDomain !contains subDomain\r\n| extend Result = iff(ForwardedtoDomain != UserDomain, \"Mailbox rule created to forward to External Domain\", \"Forward rule for Internal domain\")\r\n| extend ClientIPAddress = case(ClientIP has \".\", tostring(split(ClientIP, \":\")[0]), ClientIP has \"[\", tostring(trim_start(@'[[]', tostring(split(ClientIP, \"]\")[0]))), ClientIP)\r\n| extend Port = case(\r\n ClientIP has \".\", (split(ClientIP, \":\")[1]),\r\n ClientIP has \"[\", tostring(split(ClientIP, \"]:\")[1]),\r\n ClientIP\r\n )\r\n| summarize count() by UserId, fwdingDestination, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Email Forwarding", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "fwdingDestination", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "warning", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results95", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results95", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity \r\n| where UserId in ({UserPrincipalName})\r\n| where RecordType =~ \"SharePointFileOperation\"\r\n| where Operation =~ \"FileUploaded\" \r\n| where UserId != \"app@sharepoint\"\r\n| where SourceRelativeUrl has \"Microsoft Teams Chat Files\" \r\n| join kind= leftouter ( \r\n OfficeActivity \r\n | where RecordType =~ \"SharePointFileOperation\"\r\n | where Operation =~ \"FileDownloaded\" or Operation =~ \"FileAccessed\" \r\n | where UserId != \"app@sharepoint\"\r\n | where SourceRelativeUrl has \"Microsoft Teams Chat Files\" \r\n )\r\n on OfficeObjectId \r\n| extend userBag = pack(UserId1, ClientIP1) \r\n| summarize makeset(UserId1), make_bag(userBag) by TimeGenerated, UserId, OfficeObjectId, SourceFileName \r\n| extend NumberUsers = array_length(bag_keys(bag_userBag))\r\n| project UserId, FileLocation=OfficeObjectId, FileName=SourceFileName, AccessedBy=bag_userBag, NumberOfUsersAccessed=NumberUsers, TimeGenerated", "size": 0, "showAnalytics": true, "title": "Files Uploaded to Teams and Access Summary", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results96", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results96", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Reserved FileNames/Extension for Windows\r\nlet Reserved = dynamic(['CON', 'PRN', 'AUX', 'NUL', 'COM1', 'COM2', 'COM3', 'COM4', 'COM5', 'COM6', 'COM7', 'COM8', 'COM9', 'LPT1', 'LPT2', 'LPT3', 'LPT4', 'LPT5', 'LPT6', 'LPT7', 'LPT8', 'LPT9']);\r\nOfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where isnotempty(SourceFileExtension)\r\n| where SourceFileExtension in~ (Reserved) or SourceFileName in~ (Reserved)\r\n| where UserAgent !has \"Mac OS\" \r\n| extend SiteUrlUserFolder = tolower(split(Site_Url, '/')[-2])\r\n| extend UserIdUserFolderFormat = tolower(replace('@|\\\\.', '_', UserId))\r\n// identify when UserId is not a match to the specific site url personal folder reference\r\n| extend UserIdDiffThanUserFolder = iff(Site_Url has '/personal/' and SiteUrlUserFolder != UserIdUserFolderFormat, true, false) \r\n| summarize TimeGenerated = make_list(TimeGenerated), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_list(Operation), UserAgents = make_list(UserAgent), \r\n OfficeIds = make_list(OfficeId), SourceRelativeUrls = make_list(SourceRelativeUrl), FileNames = make_list(SourceFileName)\r\n by OfficeWorkload, RecordType, UserType, UserKey, UserId, ClientIP, Site_Url, SourceFileExtension, SiteUrlUserFolder, UserIdUserFolderFormat, UserIdDiffThanUserFolder\r\n| summarize count() by UserId\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Windows Reserved Filenames Staged on Office File Services", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results97", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results97", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Adjust this value to change how many teams a user is made owner of before detecting\r\nlet max_owner_count = 3;\r\n// Change this value to adjust how larger timeframe the query is run over.\r\nlet high_owner_count = (OfficeActivity\r\n | where OfficeWorkload =~ \"MicrosoftTeams\"\r\n | where Operation =~ \"MemberRoleChanged\"\r\n | extend Member = tostring(parse_json(Members)[0].UPN) \r\n | extend NewRole = toint(parse_json(Members)[0].Role) \r\n | where NewRole == 2\r\n | summarize dcount(TeamName) by Member\r\n | where dcount_TeamName > max_owner_count\r\n | project Member);\r\nOfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where OfficeWorkload =~ \"MicrosoftTeams\"\r\n| where Operation =~ \"MemberRoleChanged\"\r\n| extend Member = tostring(parse_json(Members)[0].UPN) \r\n| extend NewRole = toint(parse_json(Members)[0].Role) \r\n| where NewRole == 2\r\n| where Member in (high_owner_count)\r\n| summarize count() by UserId\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "User Added as Owner of Multiple Teams", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results98", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results98", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "OfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where UserType in~ (\"Admin\",\"DcAdmin\") \r\n// Only admin or global-admin can disable audit logging\r\n| where Operation =~ \"Set-AdminAuditLogConfig\" \r\n| extend AdminAuditLogEnabledValue = tostring(parse_json(tostring(parse_json(tostring(array_slice(parse_json(Parameters),3,3)))[0])).Value)\r\n| where AdminAuditLogEnabledValue =~ \"False\" \r\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() by Operation, UserType, UserId, ClientIP, ResultStatus, Parameters, AdminAuditLogEnabledValue\r\n| summarize count() by UserId\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Exchange Audit Log Disabled", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results99", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results99", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Add Keywords for Emails as needed\r\nlet Keywords = dynamic([\"helpdesk\", \" alert\", \" suspicious\", \"fake\", \"malicious\", \"phishing\", \"spam\", \"do not click\", \"do not open\", \"hijacked\", \"Fatal\"]);\r\nOfficeActivity\r\n| where UserId in ({UserPrincipalName})\r\n| where Operation =~ \"New-InboxRule\"\r\n| where Parameters has \"Deleted Items\" or Parameters has \"Junk Email\" \r\n| extend Events=todynamic(Parameters)\r\n| parse Events with * \"SubjectContainsWords\" SubjectContainsWords '}'*\r\n| parse Events with * \"BodyContainsWords\" BodyContainsWords '}'*\r\n| parse Events with * \"SubjectOrBodyContainsWords\" SubjectOrBodyContainsWords '}'*\r\n| where SubjectContainsWords has_any (Keywords)\r\n or BodyContainsWords has_any (Keywords)\r\n or SubjectOrBodyContainsWords has_any (Keywords)\r\n| extend ClientIPAddress = case( ClientIP has \".\", tostring(split(ClientIP,\":\")[0]), ClientIP has \"[\", tostring(trim_start(@'[[]',tostring(split(ClientIP,\"]\")[0]))), ClientIP )\r\n| extend Keyword = iff(isnotempty(SubjectContainsWords), SubjectContainsWords, (iff(isnotempty(BodyContainsWords),BodyContainsWords,SubjectOrBodyContainsWords )))\r\n| extend RuleDetail = case(OfficeObjectId contains '/' , tostring(split(OfficeObjectId, '/')[-1]) , tostring(split(OfficeObjectId, '\\\\')[-1]))\r\n| summarize count() by UserId\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Malicious Inbox Rule: Removing Helpdesk/Security Warning Emails", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results100", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results100", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opList = OfficeActivity \r\n| where UserId in ({UserPrincipalName})\r\n| summarize by Operation\r\n//| where Operation startswith \"Remove-\" or Operation startswith \"Disable-\"\r\n| where Operation has_any (\"Remove\", \"Disable\")\r\n| where Operation contains \"AntiPhish\" or Operation contains \"SafeAttachment\" or Operation contains \"SafeLinks\" or Operation contains \"Dlp\" or Operation contains \"Audit\"\r\n| summarize make_set(Operation);\r\nOfficeActivity\r\n// Only admin or global-admin can disable/remove policy\r\n| where RecordType =~ \"ExchangeAdmin\"\r\n| where UserType in~ (\"Admin\",\"DcAdmin\")\r\n// Pass in interesting Operation list\r\n| where Operation in~ (opList)\r\n| extend ClientIPOnly = case( \r\nClientIP has \".\", tostring(split(ClientIP,\":\")[0]), \r\nClientIP has \"[\", tostring(trim_start(@'[[]',tostring(split(ClientIP,\"]\")[0]))),\r\nClientIP\r\n) \r\n| extend Port = case(\r\nClientIP has \".\", (split(ClientIP,\":\")[1]),\r\nClientIP has \"[\", tostring(split(ClientIP,\"]:\")[1]),\r\nClientIP\r\n)\r\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() by Operation, UserType, UserId, ClientIP = ClientIPOnly, Port, ResultStatus, Parameters\r\n| summarize count() by UserId\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Office Policy Tampering", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ] }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results101", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results101", "styleSettings": { "maxWidth": "50" } } ] }, "conditionalVisibility": { "parameterName": "isM365ActivityVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Office Activity Group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "7afa304d-b448-4d6c-8c54-69e51a7249a9", "version": "KqlParameterItem/1.0", "name": "Results102", "type": 1, "query": "AuditLogs\r\n| extend UserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results102", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "658caef7-b6e6-4d04-92be-b7ff5cc8910e", "version": "KqlParameterItem/1.0", "name": "Results103", "type": 1, "query": "let action = dynamic([\"change \", \"changed \", \"reset \"]);\r\nlet pWord = dynamic([\"password \", \"credentials \"]);\r\n(union isfuzzy=true\r\n (SecurityEvent\r\n | where EventID in (4723, 4724)\r\n | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ResultDescriptions = makeset(Activity), ActionCount = count() by Resource = Computer, OperationName = strcat(\"TargetAccount: \", TargetUserName), UserId = Account, Type\r\n ),\r\n (AuditLogs\r\n | where OperationName has_any (pWord) and OperationName has_any (action)\r\n | extend InitiatedBy = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName) \r\n | extend TargetUserPrincipalName = tostring(TargetResources[0].userPrincipalName) \r\n | where ResultDescription != \"None\" \r\n | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ResultDescriptions = makeset(ResultDescription), CorrelationIds = makeset(CorrelationId), ActionCount = count() by OperationName = strcat(Category, \" - \", OperationName, \" - \", Result), Resource, UserId = TargetUserPrincipalName, Type\r\n | extend ResultDescriptions = tostring(ResultDescriptions)\r\n ),\r\n (OfficeActivity\r\n | where (ExtendedProperties has_any (pWord) or ModifiedProperties has_any (pWord)) and (ExtendedProperties has_any (action) or ModifiedProperties has_any (action))\r\n | extend ResultDescriptions = case(\r\n OfficeWorkload =~ \"AzureActiveDirectory\", tostring(ExtendedProperties),\r\n OfficeWorkload has_any (\"Exchange\", \"OneDrive\"), OfficeObjectId,\r\n RecordType) \r\n | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ResultDescriptions = makeset(ResultDescriptions), ActionCount = count() by Resource = OfficeWorkload, OperationName = strcat(Operation, \" - \", ResultStatus), IPAddress = ClientIP, UserId, Type\r\n ),\r\n (Syslog\r\n | where SyslogMessage has_any (pWord) and SyslogMessage has_any (action)\r\n | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ResultDescriptions = makeset(SyslogMessage), ActionCount = count() by Resource = HostName, OperationName = Facility, IPAddress = HostIP, ProcessName, Type\r\n ),\r\n (SigninLogs\r\n | where OperationName =~ \"Sign-in activity\" and ResultType has_any (\"50125\", \"50133\")\r\n | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ResultDescriptions = makeset(ResultDescription), CorrelationIds = makeset(CorrelationId), ActionCount = count() by Resource, OperationName = strcat(OperationName, \" - \", ResultType), IPAddress, UserId = UserPrincipalName, Type\r\n )\r\n)\r\n| extend timestamp = StartTimeUtc, AccountCustomEntity = UserId, IPCustomEntity = IPAddress\r\n| where AccountCustomEntity in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results103", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "e3a0cfd9-ab9d-479d-b355-f3db4d09b084", "version": "KqlParameterItem/1.0", "name": "Results104", "type": 1, "query": "// Extend this list with items to search for\r\nlet keywords = dynamic([\"password\", \"pwd\", \"creds\", \"credentials\", \"secret\"]);\r\n// To exclude key phrases or tables to exclude add to these lists\r\nlet table_exclusions = dynamic([\"AuditLogs\", \"SigninLogs\", \"LAQueryLogs\", \"SecurityEvent\"]);\r\nlet keyword_exclusion = dynamic([\"reset user password\", \"change user password\"]);\r\nLAQueryLogs\r\n| where RequestClientApp != 'Sentinel-General'\r\n| extend querytext_lower = tolower(QueryText)\r\n| where querytext_lower has_any(keywords)\r\n| project TimeGenerated, AADEmail, QueryText, RequestClientApp, RequestTarget, ResponseCode, ResponseRowCount, ResponseDurationMs, CorrelationId\r\n| extend timestamp = TimeGenerated, AccountCustomEntity = AADEmail\r\n| join kind=leftanti (LAQueryLogs\r\n | where RequestClientApp != 'Sentinel-General'\r\n | extend querytext_lower = tolower(QueryText)\r\n | where QueryText has_any(table_exclusions) or querytext_lower has_any(keyword_exclusion))\r\n on CorrelationId\r\n | where AccountCustomEntity in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results104", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "4d0cfde6-5b30-4824-97bb-37487f260b0b", "version": "KqlParameterItem/1.0", "name": "Results105", "type": 1, "query": "//Inactive accounts that sign in - first-time logins for accounts created in last 7 days are filtered out\r\nlet starttime = {TimeRange:grain};\r\nlet midtime = 7d;\r\nlet endtime = 1d;\r\nSigninLogs\r\n| where TimeGenerated >= ago(endtime)\r\n// successful sign-in\r\n| where ResultType == 0\r\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), loginCountToday=count() by UserPrincipalName, Identity\r\n| join kind=leftanti (\r\n SigninLogs\r\n // historical successful sign-in\r\n | where TimeGenerated < ago(endtime)\r\n | where TimeGenerated >= ago(starttime)\r\n | where ResultType == 0\r\n | summarize by UserPrincipalName, Identity\r\n )\r\n on UserPrincipalName \r\n| join kind= leftanti (\r\n // filter out newly created user accounts\r\n AuditLogs\r\n | where TimeGenerated >= ago(midtime)\r\n | where OperationName == \"Add user\" \r\n // Normalize to lower case in order to match against equivalent UPN in Signin logs\r\n | extend NewUserPrincipalName = tolower(extractjson(\"$.userPrincipalName\", tostring(TargetResources[0]), typeof(string)))\r\n )\r\n on $left.UserPrincipalName == $right.NewUserPrincipalName \r\n| extend timestamp = StartTime, AccountCustomEntity = UserPrincipalName\r\n| where AccountCustomEntity in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results105", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "e6f952e3-6516-4ea5-b53b-fdf6b6869c81", "version": "KqlParameterItem/1.0", "name": "Results106", "type": 1, "query": "let PerUserThreshold = 5;\r\nlet TotalThreshold = 100;\r\nlet action = dynamic([\"change\", \"changed\", \"reset\"]);\r\nlet pWord = dynamic([\"password\", \"credentials\"]);\r\nlet PasswordResetMultiDataSource =\r\n (union isfuzzy=true\r\n (//Password reset events\r\n //4723: An attempt was made to change an account's password\r\n //4724: An attempt was made to reset an accounts password\r\n SecurityEvent\r\n | where EventID in (\"4723\", \"4724\")\r\n | project TimeGenerated, Computer, AccountType, Account, Type),\r\n (//Azure Active Directory Password reset events\r\n AuditLogs\r\n | where OperationName has_any (pWord) and OperationName has_any (action)\r\n | extend AccountType = tostring(TargetResources[0].type), Account = tostring(TargetResources[0].userPrincipalName), \r\n TargetResourceName = tolower(tostring(TargetResources[0].displayName))\r\n | project TimeGenerated, AccountType, Account, Computer = TargetResourceName, Type),\r\n (//OfficeActive ActiveDirectory Password reset events\r\n OfficeActivity\r\n | where OfficeWorkload == \"AzureActiveDirectory\" \r\n | where (ExtendedProperties has_any (pWord) or ModifiedProperties has_any (pWord)) and (ExtendedProperties has_any (action) or ModifiedProperties has_any (action))\r\n | extend AccountType = UserType, Account = OfficeObjectId \r\n | project TimeGenerated, AccountType, Account, Type, Computer = \"\"),\r\n (// Unix syslog password reset events\r\n Syslog\r\n | where Facility in (\"auth\", \"authpriv\")\r\n | where SyslogMessage has_any (pWord) and SyslogMessage has_any (action)\r\n | extend AccountType = iif(SyslogMessage contains \"root\", \"Root\", \"Non-Root\")\r\n | parse SyslogMessage with * \"password changed for\" Account\r\n | project TimeGenerated, AccountType, Account, Computer = HostName, Type),\r\n (SigninLogs\r\n | where OperationName =~ \"Sign-in activity\" and ResultType has_any (\"50125\", \"50133\")\r\n | project TimeGenerated, AccountType = AppDisplayName, Computer = IPAddress, Account = UserPrincipalName, Type\r\n )\r\n );\r\nlet pwrmd = PasswordResetMultiDataSource\r\n | project TimeGenerated, Computer, AccountType, Account, Type;\r\n(union isfuzzy=true \r\n (pwrmd\r\n | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Computer = makeset(Computer), AccountType = makeset(AccountType), Total=count() by Account, Type\r\n | where Total > PerUserThreshold\r\n | extend ResetPivot = \"PerUserReset\"), \r\n (pwrmd\r\n | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Computer = makeset(Computer), Account = tostring(makeset(Account)), AccountType = makeset(AccountType), Total=count() by Type\r\n | where Total > TotalThreshold\r\n | extend ResetPivot = \"TotalUserReset\")\r\n)\r\n| extend timestamp = StartTimeUtc, AccountCustomEntity = Account, HostCustomEntity = tostring(Computer)\r\n| where AccountCustomEntity in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results106", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "4f1e1636-66f4-42ab-ba63-f0046df90e09", "version": "KqlParameterItem/1.0", "name": "Results107", "type": 1, "query": "let current = 1d;\r\nlet auditLookback = {TimeRange:grain};\r\nlet propertyIgnoreList = dynamic([\"TargetId.UserType\", \"StsRefreshTokensValidFrom\", \"LastDirSyncTime\", \"DeviceOSVersion\", \"CloudDeviceOSVersion\", \"DeviceObjectVersion\"]);\r\nlet AuditTrail = AuditLogs\r\n | where TimeGenerated >= ago(auditLookback) and TimeGenerated < ago(current)\r\n | where isnotempty(tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName))\r\n | extend InitiatedByUser = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)\r\n | extend InitiatedByIPAddress = tostring(parse_json(tostring(InitiatedBy.user)).ipAddress)\r\n | extend ModProps = TargetResources.[0].modifiedProperties\r\n | extend TargetUserPrincipalName = tolower(tostring(TargetResources.[0].userPrincipalName))\r\n | extend TargetResourceName = tolower(tostring(TargetResources.[0].displayName))\r\n | mv-expand ModProps\r\n | extend PropertyName = tostring(ModProps.displayName), newValue = tostring(parse_json(tostring(ModProps.newValue))[0])\r\n | where PropertyName !in~ (propertyIgnoreList) and (PropertyName !~ \"Action Client Name\" and newValue !~ \"DirectorySync\") and (PropertyName !~ \"Included Updated Properties\" and newValue !~ \"LastDirSyncTime\")\r\n | summarize count() by OperationName, InitiatedByUser, InitiatedByIPAddress, TargetUserPrincipalName, PropertyName, TargetResourceName;\r\nlet AccountMods = AuditLogs \r\n | where TimeGenerated >= ago(current)\r\n | where isnotempty(tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName))\r\n | extend InitiatedByUser = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)\r\n | extend InitiatedByIPAddress = tostring(parse_json(tostring(InitiatedBy.user)).ipAddress)\r\n | extend ModProps = TargetResources.[0].modifiedProperties\r\n | extend TargetUserPrincipalName = tolower(tostring(TargetResources.[0].userPrincipalName))\r\n | extend TargetResourceName = tolower(tostring(TargetResources.[0].displayName))\r\n | mv-expand ModProps\r\n | extend PropertyName = tostring(ModProps.displayName), newValue = tostring(parse_json(tostring(ModProps.newValue))[0])\r\n | where PropertyName !in~ (propertyIgnoreList) and (PropertyName !~ \"Action Client Name\" and newValue !~ \"DirectorySync\") and (PropertyName !~ \"Included Updated Properties\" and newValue !~ \"LastDirSyncTime\")\r\n | extend ModifiedProps = pack(\"PropertyName\", PropertyName, \"newValue\", newValue, \"Id\", Id, \"CorrelationId\", CorrelationId) \r\n | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Activity = make_bag(ModifiedProps) by Type, InitiatedByUser, InitiatedByIPAddress, TargetUserPrincipalName, Category, OperationName, PropertyName, TargetResourceName;\r\nlet RareAudits = AccountMods\r\n | join kind= leftanti (\r\n AuditTrail \r\n )\r\n on OperationName, InitiatedByUser, InitiatedByIPAddress;//, TargetUserPrincipalName, PropertyName; //uncomment if you want to see Rare Property changes to a given TargetUserPrincipalName.\r\nRareAudits \r\n| summarize StartTime = min(StartTimeUtc), EndTime = max(EndTimeUtc), make_set(Activity), make_set(PropertyName) by Type, InitiatedByUser, InitiatedByIPAddress, OperationName, TargetUserPrincipalName, TargetResourceName\r\n| extend timestamp = StartTime, AccountCustomEntity = InitiatedByUser, HostCustomEntity = iff(set_PropertyName has_any ('DeviceOSType', 'CloudDeviceOSType'), TargetResourceName, ''), IPCustomEntity = InitiatedByIPAddress\r\n| where AccountCustomEntity in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results107", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "75c81ac6-d658-48ee-85b0-8bce3559128a", "version": "KqlParameterItem/1.0", "name": "Results108", "type": 1, "query": "let auditLookback = {TimeRange:grain};\r\n// Setting threshold to 3 as a default, change as needed. Any operation that has been initiated by a user or app more than 3 times in the past 30 days will be exluded\r\nlet threshold = 3;\r\n// Helper function to extract relevant fields from AuditLog events\r\nlet auditLogEvents = view (startTimeSpan: timespan) {\r\n AuditLogs\r\n | where TimeGenerated >= ago(auditLookback)\r\n | extend ModProps = TargetResources.[0].modifiedProperties\r\n | extend IpAddress = iff(isnotempty(tostring(parse_json(tostring(InitiatedBy.user)).ipAddress)), \r\n tostring(parse_json(tostring(InitiatedBy.user)).ipAddress), tostring(parse_json(tostring(InitiatedBy.app)).ipAddress))\r\n | extend InitiatedBy = iff(isnotempty(tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)), \r\n tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName), tostring(parse_json(tostring(InitiatedBy.app)).displayName))\r\n | extend TargetResourceName = tolower(tostring(TargetResources.[0].displayName))\r\n | mvexpand ModProps\r\n | extend PropertyName = tostring(ModProps.displayName), newValue = replace('\\\"', \"\", tostring(ModProps.newValue));\r\n};\r\n// Get just the InitiatedBy and CorrleationId so we can look at associated audit activity\r\n// 2 other operations that can be part of malicious activity in this situation are \r\n// \"Add OAuth2PermissionGrant\" and \"Add service principal\", replace the below if you are interested in those as starting points for OperationName\r\nlet HistoricalConsent = auditLogEvents(auditLookback) \r\n | where OperationName == \"Consent to application\"\r\n | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() \r\n by Type, InitiatedBy, IpAddress, TargetResourceName, Category, OperationName, PropertyName, newValue, CorrelationId, Id\r\n// Remove comment below to only include operations initiated by a user or app that is above the threshold for the last 30 days\r\n//| where OperationCount > threshold\r\n;\r\nlet Correlate = HistoricalConsent \r\n | summarize by InitiatedBy, CorrelationId;\r\n// 2 other operations that can be part of malicious activity in this situation are \r\n// \"Add OAuth2PermissionGrant\" and \"Add service principal\", replace the below if you changed the starting OperationName above\r\nlet allOtherEvents = auditLogEvents(auditLookback) \r\n | where OperationName != \"Consent to application\";\r\n// Gather associated activity based on audit activity for \"Consent to application\" and InitiatedBy and CorrleationId\r\nlet CorrelatedEvents = Correlate \r\n | join allOtherEvents on InitiatedBy, CorrelationId\r\n | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) \r\n by Type, InitiatedBy, IpAddress, TargetResourceName, Category, OperationName, PropertyName, newValue, CorrelationId, Id\r\n;\r\n// Union the results\r\nlet Results = union isfuzzy=true HistoricalConsent, CorrelatedEvents;\r\n// newValues that are simple semi-colon separated, make those dynamic for easy viewing and Aggregate into the PropertyUpdate set based on CorrelationId and Id(DirectoryId)\r\nResults\r\n| extend newValue = split(newValue, \";\")\r\n| extend PropertyUpdate = pack(PropertyName, newValue, \"Id\", Id)\r\n// Extract scope requested\r\n| extend perms = tostring(parse_json(tostring(PropertyUpdate.[\"ConsentAction.Permissions\"]))[0])\r\n| extend scope = extract('Scope:\\\\s*([^,\\\\]]*)', 1, perms)\r\n// Filter out some common openid, and low privilege request scopes - uncomment line below to filter out where no scope is requested\r\n//| where isnotempty(scope)\r\n| where scope !contains 'openid' and scope !in ('user_impersonation', 'User.Read')\r\n| summarize StartTime = min(StartTimeUtc), EndTime = max(EndTimeUtc), PropertyUpdateSet = make_bag(PropertyUpdate), make_set(scope)\r\n by InitiatedBy, IpAddress, TargetResourceName, OperationName, CorrelationId\r\n| extend timestamp = StartTime, AccountCustomEntity = InitiatedBy, IPCustomEntity = IpAddress\r\n| where AccountCustomEntity in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results108", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "d415a546-9cf6-444b-b60c-d3bfb5b04cd5", "version": "KqlParameterItem/1.0", "name": "Results109", "type": 1, "query": "let auditLookback = {TimeRange:grain};\r\nlet opName = dynamic([\"Add user\", \"Invite external user\"]);\r\n// Helper function to extract relevant fields from AuditLog events\r\nlet auditLogEvents = view (startTimeSpan: timespan, operation: dynamic) {\r\n AuditLogs\r\n | where TimeGenerated >= ago(auditLookback)\r\n | where OperationName in~ (operation)\r\n | extend ModProps = iff(TargetResources.[0].modifiedProperties != \"[]\", TargetResources.[0].modifiedProperties, todynamic(\"NoValues\"))\r\n | extend IpAddress = iff(isnotempty(tostring(parse_json(tostring(InitiatedBy.user)).ipAddress)), \r\n tostring(parse_json(tostring(InitiatedBy.user)).ipAddress), tostring(parse_json(tostring(InitiatedBy.app)).ipAddress))\r\n | extend InitiatedByFull = iff(isnotempty(tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)), \r\n tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName), tostring(parse_json(tostring(InitiatedBy.app)).displayName))\r\n | extend InitiatedBy = replace(\"_\", \"@\", tostring(split(InitiatedByFull, \"#\")[0]))\r\n | extend TargetUserPrincipalName = tostring(TargetResources[0].userPrincipalName)\r\n | extend TargetUserName = replace(\"_\", \"@\", tostring(split(TargetUserPrincipalName, \"#\")[0]))\r\n | extend TargetResourceName = case(\r\n isempty(tostring(TargetResources.[0].displayName)), TargetUserPrincipalName,\r\n isnotempty(tostring(TargetResources.[0].displayName)) and tostring(TargetResources.[0].displayName) startswith \"upn:\", tolower(tostring(TargetResources.[0].displayName)),\r\n tolower(tostring(TargetResources.[0].displayName))\r\n )\r\n | extend TargetUserName = replace(\"_\", \"@\", tostring(split(TargetUserPrincipalName, \"#\")[0]))\r\n | extend TargetUserName = iff(isempty(TargetUserName), tostring(split(split(TargetResourceName, \",\")[0], \" \")[1]), TargetUserName) \r\n | mvexpand ModProps\r\n | extend PropertyName = tostring(ModProps.displayName), newValue = replace('\\\"', '', tostring(ModProps.newValue));\r\n};\r\n// Assigning time for First TargetUserName that was added\r\nlet FirstAdd = auditLogEvents(auditLookback, opName) \r\n | project FirstAddTimeUtc = TimeGenerated, Type, FirstInitiatedBy = InitiatedBy, IpAddress, FirstTargetUserName = TargetUserName, FirstTargetResourceName = TargetResourceName, \r\n FirstOperationName = OperationName, FirstPropertyName = PropertyName, FirstnewValue = newValue, FirstCorrelationId = CorrelationId, FirstId = Id;\r\n// Assigning time for second TargetUserName that was added, which will allow us to see if a first TargetUserName added in is the Initiated by on the second in the later join\r\nlet SecondAdd = auditLogEvents(auditLookback, opName) \r\n | project SecondAddTimeUtc = TimeGenerated, Type, SecondInitiatedBy = InitiatedBy, IpAddress, SecondTargetUserName = TargetUserName, SecondTargetResourceName = TargetResourceName, \r\n SecondOperationName = OperationName, SecondPropertyName = PropertyName, SecondnewValue = newValue, SecondCorrelationId = CorrelationId, SecondId = Id;\r\n// Joining the FirstAdd with SecondAdd where the FirstAdd TargetUserName value matches the SecondAdd InitiatedBy. This shows the new user adding a user.\r\nlet NewUserAddsUser = FirstAdd\r\n | join SecondAdd on $left.FirstTargetUserName == $right.SecondInitiatedBy\r\n // we only want items where the FirstAddTimeUtc is before the SecondAddTimeUtc\r\n | where FirstAddTimeUtc < SecondAddTimeUtc\r\n;\r\n// Build out some of the properties for context\r\nNewUserAddsUser\r\n| extend FirstnewValue = split(FirstnewValue, \";\"), SecondnewValue = split(SecondnewValue, \";\")\r\n| extend PropertyUpdate = pack(FirstPropertyName, FirstnewValue, SecondPropertyName, SecondnewValue, \"FirstCorrelationId\", FirstCorrelationId, \"FirstId\", FirstId, \"SecondCorrelationId\", SecondCorrelationId, \"SecondId\", SecondId)\r\n| summarize PropertyUpdateSet = make_bag(PropertyUpdate)\r\n by FirstAddTimeUtc, FirstInitiatedBy, FirstTargetUserName, SecondAddTimeUtc, SecondInitiatedBy, SecondTargetUserName, \r\n IpAddress, FirstTargetResourceName, SecondTargetResourceName, FirstOperationName, SecondOperationName\r\n| extend timestamp = FirstAddTimeUtc, AccountCustomEntity = FirstInitiatedBy, HostCustomEntity = FirstTargetResourceName, IPCustomEntity = IpAddress\r\n| where AccountCustomEntity in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results109", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "380e403d-faec-48d8-83ec-23342a1e072b", "version": "KqlParameterItem/1.0", "name": "Results110", "type": 1, "query": "// Provide customLimit value with default above domainLimit value so it will not block unless changed\r\nlet customLimit = 11;\r\nlet domainLimit = 10;\r\nlet domainLookback = union isfuzzy=true\r\n (AuditLogs\r\n | extend UserPrincipalName = tolower(tostring(TargetResources.[0].userPrincipalName))\r\n // parse out AuditLog values for various locations where UPN could be\r\n | extend UserPrincipalName = iff(isnotempty(UserPrincipalName),\r\n UserPrincipalName, \r\n iif((tostring(InitiatedBy.user.userPrincipalName) == 'unknown'), \r\n extract(\"Email: ([a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\\\\.[a-zA-Z0-9-.]+)\", 1, tostring(parse_json(TargetResources)[0].displayName)), \r\n InitiatedBy.user.userPrincipalName))\r\n | where UserPrincipalName has \"@\" or UserPrincipalName startswith \"NT AUTHORITY\"\r\n | extend RareDomain = toupper(tostring(split(UserPrincipalName, \"@\")[-1]))\r\n | where isnotempty(RareDomain) \r\n | summarize RareDomainCount = count() by Type, RareDomain\r\n | where RareDomainCount <= domainLimit\r\n | extend AccountCustomEntity = UserPrincipalName\r\n // remove comment from below if you would like to have a lower limit for RareDomainCount specific to AuditLog\r\n //| where RareDomainCount <= customLimit\r\n ),\r\n (OfficeActivity\r\n | extend UserPrincipalName = tolower(UserId)\r\n | where UserPrincipalName has \"@\" or UserPrincipalName startswith \"NT AUTHORITY\"\r\n | extend RareDomain = toupper(tostring(split(UserPrincipalName, \"@\")[-1]))\r\n | summarize RareDomainCount = count() by Type, RareDomain\r\n | where RareDomainCount <= domainLimit\r\n | extend AccountCustomEntity = UserPrincipalName\r\n // remove comment from below if you would like to have a lower limit for RareDomainCount specific to OfficeActivity\r\n //| where RareDomainCount <= customLimit\r\n ),\r\n (SigninLogs\r\n | where UserPrincipalName has \"@\" or UserPrincipalName startswith \"NT AUTHORITY\"\r\n | extend RareDomain = toupper(tostring(split(UserPrincipalName, \"@\")[-1]))\r\n | summarize RareDomainCount = count() by Type, RareDomain\r\n | where RareDomainCount <= domainLimit\r\n // remove comment from below if you would like to have a lower limit for RareDomainCount specific to SigninLogs\r\n //| where RareDomainCount <= customLimit\r\n );\r\nlet AuditLogsRef = domainLookback\r\n | join (\r\n AuditLogs\r\n | extend UserPrincipalName = tolower(tostring(TargetResources.[0].userPrincipalName))\r\n | extend UserPrincipalName = iff(isempty(UserPrincipalName), tostring(InitiatedBy.user.userPrincipalName), UserPrincipalName)\r\n | extend RareDomain = toupper(tostring(split(UserPrincipalName, \"@\")[-1]))\r\n | where isnotempty(RareDomain) \r\n | summarize UPNRefCount = count() by TimeGenerated, Type, RareDomain, UserPrincipalName, OperationName, Category, Result\r\n | extend AccountCustomEntity = UserPrincipalName\r\n )\r\n on Type, RareDomain;\r\nlet OfficeActivityRef = domainLookback\r\n | join (\r\n OfficeActivity\r\n | extend UserPrincipalName = tolower(UserId)\r\n | where UserPrincipalName has \"@\" or UserPrincipalName startswith \"NT AUTHORITY\"\r\n | extend RareDomain = toupper(tostring(split(UserPrincipalName, \"@\")[-1]))\r\n | summarize UPNRefCount = count() by TimeGenerated, Type, RareDomain, UserPrincipalName, OperationName = Operation, Category = OfficeWorkload, Result = ResultStatus\r\n | extend AccountCustomEntity = UserPrincipalName\r\n )\r\n on Type, RareDomain;\r\nlet SigninLogsRef = domainLookback\r\n | join (\r\n SigninLogs\r\n | extend UserPrincipalName = tolower(UserId)\r\n | where UserPrincipalName has \"@\" or UserPrincipalName startswith \"NT AUTHORITY\"\r\n | extend RareDomain = toupper(tostring(split(UserPrincipalName, \"@\")[-1]))\r\n | summarize UPNRefCount = count() by TimeGenerated, Type, RareDomain, UserPrincipalName, OperationName, Category = AppDisplayName, Result = ResultType\r\n | extend AccountCustomEntity = UserPrincipalName\r\n )\r\n on Type, RareDomain;\r\nlet Results = union isfuzzy=true\r\n AuditLogsRef, OfficeActivityRef, SigninLogsRef;\r\nResults\r\n| project TimeGenerated, Type, RareDomain, UserPrincipalName, OperationName, Category, Result, UPNRefCount \r\n| order by TimeGenerated asc \r\n| extend timestamp = TimeGenerated, AccountCustomEntity = UserPrincipalName\r\n| where AccountCustomEntity in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results110", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "d14ed542-4843-4c2d-8309-55440ff2a0a7", "version": "KqlParameterItem/1.0", "name": "Results111", "type": 1, "query": "let auditLookback = {TimeRange:grain};\r\nlet opName = dynamic([\"Add user\", \"Invite external user\"]);\r\n// Helper function to extract relevant fields from AuditLog events\r\nlet auditLogEvents = view (startTimeSpan: timespan, operation: dynamic) {\r\n AuditLogs\r\n | where TimeGenerated >= ago(auditLookback)\r\n | where OperationName in~ (operation)\r\n | extend UserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)\r\n | where UserPrincipalName in ({UserPrincipalName})\r\n | extend ModProps = iff(TargetResources.[0].modifiedProperties != \"[]\", TargetResources.[0].modifiedProperties, todynamic(\"NoValues\"))\r\n | extend IpAddress = iff(isnotempty(tostring(parse_json(tostring(InitiatedBy.user)).ipAddress)), \r\n tostring(parse_json(tostring(InitiatedBy.user)).ipAddress), tostring(parse_json(tostring(InitiatedBy.app)).ipAddress))\r\n | extend InitiatedByFull = iff(isnotempty(tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)), \r\n tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName), tostring(parse_json(tostring(InitiatedBy.app)).displayName))\r\n | extend InitiatedBy = replace(\"_\", \"@\", tostring(split(InitiatedByFull, \"#\")[0]))\r\n | extend TargetUserPrincipalName = tostring(TargetResources[0].userPrincipalName)\r\n | extend TargetUserName = replace(\"_\", \"@\", tostring(split(TargetUserPrincipalName, \"#\")[0]))\r\n | extend TargetResourceName = case(\r\n isempty(tostring(TargetResources.[0].displayName)), TargetUserPrincipalName,\r\n isnotempty(tostring(TargetResources.[0].displayName)) and tostring(TargetResources.[0].displayName) startswith \"upn:\", tolower(tostring(TargetResources.[0].displayName)),\r\n tolower(tostring(TargetResources.[0].displayName))\r\n )\r\n | extend TargetUserName = replace(\"_\", \"@\", tostring(split(TargetUserPrincipalName, \"#\")[0]))\r\n | extend TargetUserName = iff(isempty(TargetUserName), tostring(split(split(TargetResourceName, \",\")[0], \" \")[1]), TargetUserName) \r\n | mvexpand ModProps\r\n | extend PropertyName = tostring(ModProps.displayName), newValue = replace(\"\\\"\", \"\", tostring(ModProps.newValue));\r\n};\r\nlet UserAdd = auditLogEvents(auditLookback, opName) \r\n | project Action = \"User Added\", TimeGenerated, Type, InitiatedBy_Caller = InitiatedBy, IpAddress, TargetUserName = tolower(TargetUserName), OperationName, PropertyName_ResourceId = PropertyName, Value = newValue;\r\n// Get the simple list of creatd users so we can use later to get just the associated resource creation events\r\nlet SimpleUserList = UserAdd\r\n | project TimeGenerated, TargetUserName;\r\nlet ResourceCreation = AzureActivity\r\n | where TimeGenerated >= ago(auditLookback)\r\n // We look for any Operation that created and then succeeded where ActivityStatus has a value so that we can provide context\r\n | where OperationName has \"Create\"\r\n | where ActivityStatus has \"Succeeded\"\r\n | project Action = \"Resource Created\", ResourceCreationTimeGenerated = TimeGenerated, Type, InitiatedBy_Caller = tolower(Caller), IpAddress = CallerIpAddress, OperationName, Value = OperationNameValue, PropertyName_ResourceId = ResourceId;\r\n// Get just the Resources added by the new user\r\nlet ResourceMatch = SimpleUserList\r\n | join kind= innerunique (\r\n ResourceCreation\r\n )\r\n on $left.TargetUserName == $right.InitiatedBy_Caller\r\n // where the resource creation is after (greater than) the user addition\r\n | where TimeGenerated < ResourceCreationTimeGenerated\r\n | project-away TimeGenerated \r\n | project-rename TimeGenerated = ResourceCreationTimeGenerated\r\n;\r\nlet SimpleResourceMatch = ResourceMatch\r\n | project InitiatedBy_Caller;\r\n// Get only resource add, remove, change by the new user\r\nlet UserAddWithResource = SimpleResourceMatch\r\n | join kind= rightsemi (\r\n UserAdd \r\n )\r\n on $left.InitiatedBy_Caller == $right.TargetUserName;\r\n// union the user addition events and resource addition events and provide common column names, additionally pack the value, property and resource info to reduce result set.\r\nUserAddWithResource \r\n| union isfuzzy=true ResourceMatch\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results111", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "d0f5e554-de83-438a-9c4a-be05649f8d1f", "version": "KqlParameterItem/1.0", "name": "Results112", "type": 1, "isRequired": true, "query": "(union isfuzzy=true\r\n(\r\nAuditLogs\r\n| extend UserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)\r\n| where OperationName =~ \"Set federation settings on domain\"\r\n//| where Result =~ \"success\" // commenting out, as it may be interesting to capture failed attempts\r\n| mv-expand TargetResources\r\n| extend modifiedProperties = parse_json(TargetResources).modifiedProperties\r\n| mv-expand modifiedProperties\r\n| extend targetDisplayName = tostring(parse_json(modifiedProperties).displayName)\r\n| mv-expand AdditionalDetails\r\n),\r\n(\r\nAuditLogs\r\n| where OperationName =~ \"Set domain authentication\"\r\n//| where Result =~ \"success\" // commenting out, as it may be interesting to capture failed attempts\r\n| mv-expand TargetResources\r\n| extend modifiedProperties = parse_json(TargetResources).modifiedProperties\r\n| mv-expand modifiedProperties\r\n| extend targetDisplayName = tostring(parse_json(modifiedProperties).displayName), NewDomainValue=tostring(parse_json(modifiedProperties).newValue)\r\n| where NewDomainValue has \"Federated\"\r\n))\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Results112" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Audit Logs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/auditlogs)\n---\n\nAudit log for Microsoft Entra ID. Includes system activity information about user and group management managed applications and directory activities. Log query audit logs provide telemetry about log queries run in Azure Monitor. This includes information such as when a query was run, who ran it, what tool was used, the query text, and performance statistics describing the query's execution.\n\n\n\n" }, "name": "text - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "4a388baf-b1ed-4d69-9b31-58039271c260", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Entra ID >>", "style": "secondary", "bladeOpenContext": { "bladeName": "ActiveDirectoryMenuBlade", "extensionName": "Microsoft_AAD_IAM", "bladeParameters": [] } } ] }, "customWidth": "50", "name": "EL0" } ] }, "customWidth": "40", "name": "group - 27" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 26" }, { "type": 1, "content": { "json": "| Audit Log Queries | - | - |\r\n|:--| :--| :--|\r\n| Audit Logs by Operations | Most Failed Operations | Most Successful Operations |\r\n| Changing Passwords Across Multiple Cloud Accounts | Searching for Secrets & Passwords | Inactive or New Account Sign-Ins |\r\n| Multiple Password Resets | Rare Audit Activity Initiated |Consent to Application Discovery |\r\n| Granted Access and Grants Others Access |Rare Domains Observed in Cloud Logs | User Granted Access and Creates Resources |\r\n| User Modified Domain Federation Trust Settings | | |\r\n\r\nThis section is bound by the above parameters for Subscription, Workspace, TimeRange, and User. Panels are dynamically displayed meaning numerous queries are executed and only panels returning data are displayed. " }, "customWidth": "40", "name": "SI OV" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| extend UserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| summarize count() by OperationName\r\n| render piechart\r\n", "size": 0, "showAnalytics": true, "title": "Audit Logs by Operations", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ] } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results102", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results102", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| extend UserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| summarize Runs = count(), Success = countif(Result == 'success'), Fails = countif(Result != 'success') by OperationName // Summarize the total, successful and failed operations by name\r\n| extend SuccessRate = (Success * 100 / Runs) // Calculate the percentage of succesful operations against the total\r\n| project OperationName, Runs, Fails, SuccessRate\r\n| sort by Fails desc\r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "Most Failed Operations", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "OperationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "Runs", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "SuccessRate", "formatter": 8, "formatOptions": { "palette": "green" } }, { "columnMatch": "Fails", "formatter": 8, "formatOptions": { "palette": "red" } }, { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ], "filter": true } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results102", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results102b", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| extend UserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| summarize Runs = count(), Success = countif(Result == 'success'), Fails = countif(Result != 'success') by OperationName // Summarize the total, successful and failed operations by name\r\n| extend SuccessRate = (Success * 100 / Runs) // Calculate the percentage of succesful operations against the total\r\n| project OperationName, Runs, SuccessRate, Fails\r\n| sort by SuccessRate desc\r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "Most Successful Operations", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "OperationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "Runs", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "SuccessRate", "formatter": 8, "formatOptions": { "palette": "green" } }, { "columnMatch": "Fails", "formatter": 8, "formatOptions": { "palette": "red" } }, { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_heatmap_SuccessRate_2", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_heatmap_SuccessRate_2", "sortOrder": 2 } ] }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results102", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results102c", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let action = dynamic([\"change \", \"changed \", \"reset \"]);\r\nlet pWord = dynamic([\"password \", \"credentials \"]);\r\n(union isfuzzy=true\r\n (SecurityEvent\r\n | where EventID in (4723, 4724)\r\n | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ResultDescriptions = makeset(Activity), ActionCount = count() by Resource = Computer, OperationName = strcat(\"TargetAccount: \", TargetUserName), UserId = Account, Type\r\n ),\r\n (AuditLogs\r\n | where OperationName has_any (pWord) and OperationName has_any (action)\r\n | extend InitiatedBy = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName) \r\n | extend TargetUserPrincipalName = tostring(TargetResources[0].userPrincipalName) \r\n | where ResultDescription != \"None\" \r\n | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ResultDescriptions = makeset(ResultDescription), CorrelationIds = makeset(CorrelationId), ActionCount = count() by OperationName = strcat(Category, \" - \", OperationName, \" - \", Result), Resource, UserId = TargetUserPrincipalName, Type\r\n | extend ResultDescriptions = tostring(ResultDescriptions)\r\n ),\r\n (OfficeActivity\r\n | where (ExtendedProperties has_any (pWord) or ModifiedProperties has_any (pWord)) and (ExtendedProperties has_any (action) or ModifiedProperties has_any (action))\r\n | extend ResultDescriptions = case(\r\n OfficeWorkload =~ \"AzureActiveDirectory\", tostring(ExtendedProperties),\r\n OfficeWorkload has_any (\"Exchange\", \"OneDrive\"), OfficeObjectId,\r\n RecordType) \r\n | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ResultDescriptions = makeset(ResultDescriptions), ActionCount = count() by Resource = OfficeWorkload, OperationName = strcat(Operation, \" - \", ResultStatus), IPAddress = ClientIP, UserId, Type\r\n ),\r\n (Syslog\r\n | where SyslogMessage has_any (pWord) and SyslogMessage has_any (action)\r\n | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ResultDescriptions = makeset(SyslogMessage), ActionCount = count() by Resource = HostName, OperationName = Facility, IPAddress = HostIP, ProcessName, Type\r\n ),\r\n (SigninLogs\r\n | where OperationName =~ \"Sign-in activity\" and ResultType has_any (\"50125\", \"50133\")\r\n | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ResultDescriptions = makeset(ResultDescription), CorrelationIds = makeset(CorrelationId), ActionCount = count() by Resource, OperationName = strcat(OperationName, \" - \", ResultType), IPAddress, UserId = UserPrincipalName, Type\r\n )\r\n)\r\n| extend timestamp = StartTimeUtc, AccountCustomEntity = UserId, IPCustomEntity = IPAddress\r\n| where AccountCustomEntity in ({UserPrincipalName})\r\n| summarize count() by AccountCustomEntity\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Changing Passwords Across Multiple Cloud Accounts", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AccountCustomEntity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ], "filter": true } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results103", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results103", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Extend this list with items to search for\r\nlet keywords = dynamic([\"password\", \"pwd\", \"creds\", \"credentials\", \"secret\"]);\r\n// To exclude key phrases or tables to exclude add to these lists\r\nlet table_exclusions = dynamic([\"AuditLogs\", \"SigninLogs\", \"LAQueryLogs\", \"SecurityEvent\"]);\r\nlet keyword_exclusion = dynamic([\"reset user password\", \"change user password\"]);\r\nLAQueryLogs\r\n| where RequestClientApp != 'Sentinel-General'\r\n| extend querytext_lower = tolower(QueryText)\r\n| where querytext_lower has_any(keywords)\r\n| project TimeGenerated, AADEmail, QueryText, RequestClientApp, RequestTarget, ResponseCode, ResponseRowCount, ResponseDurationMs, CorrelationId\r\n| extend timestamp = TimeGenerated, AccountCustomEntity = AADEmail\r\n| join kind=leftanti (LAQueryLogs\r\n | where RequestClientApp != 'Sentinel-General'\r\n | extend querytext_lower = tolower(QueryText)\r\n | where QueryText has_any(table_exclusions) or querytext_lower has_any(keyword_exclusion))\r\n on CorrelationId\r\n | where AccountCustomEntity in ({UserPrincipalName})\r\n| summarize count() by AccountCustomEntity\r\n| sort by count_ desc ", "size": 0, "showAnalytics": true, "title": "Searching for Secrets & Passwords", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AccountCustomEntity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ], "filter": true } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results104", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results104", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Inactive accounts that sign in - first-time logins for accounts created in last 7 days are filtered out\r\nlet starttime = {TimeRange:grain};\r\nlet midtime = 7d;\r\nlet endtime = 1d;\r\nSigninLogs\r\n| where TimeGenerated >= ago(endtime)\r\n// successful sign-in\r\n| where ResultType == 0\r\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), loginCountToday=count() by UserPrincipalName, Identity\r\n| join kind=leftanti (\r\n SigninLogs\r\n // historical successful sign-in\r\n | where TimeGenerated < ago(endtime)\r\n | where TimeGenerated >= ago(starttime)\r\n | where ResultType == 0\r\n | summarize by UserPrincipalName, Identity\r\n )\r\n on UserPrincipalName \r\n| join kind= leftanti (\r\n // filter out newly created user accounts\r\n AuditLogs\r\n | where TimeGenerated >= ago(midtime)\r\n | where OperationName == \"Add user\" \r\n // Normalize to lower case in order to match against equivalent UPN in Signin logs\r\n | extend NewUserPrincipalName = tolower(extractjson(\"$.userPrincipalName\", tostring(TargetResources[0]), typeof(string)))\r\n )\r\n on $left.UserPrincipalName == $right.NewUserPrincipalName \r\n| extend timestamp = StartTime, AccountCustomEntity = UserPrincipalName\r\n| where AccountCustomEntity in ({UserPrincipalName})\r\n| summarize count() by AccountCustomEntity\r\n| sort by count_ desc\r\n", "size": 0, "showAnalytics": true, "title": "User Inactive or New Account Sign-Ins", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AccountCustomEntity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ], "filter": true } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results105", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results105", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let PerUserThreshold = 5;\r\nlet TotalThreshold = 100;\r\nlet action = dynamic([\"change\", \"changed\", \"reset\"]);\r\nlet pWord = dynamic([\"password\", \"credentials\"]);\r\nlet PasswordResetMultiDataSource =\r\n (union isfuzzy=true\r\n (//Password reset events\r\n //4723: An attempt was made to change an account's password\r\n //4724: An attempt was made to reset an accounts password\r\n SecurityEvent\r\n | where EventID in (\"4723\", \"4724\")\r\n | project TimeGenerated, Computer, AccountType, Account, Type),\r\n (//Azure Active Directory Password reset events\r\n AuditLogs\r\n | where OperationName has_any (pWord) and OperationName has_any (action)\r\n | extend AccountType = tostring(TargetResources[0].type), Account = tostring(TargetResources[0].userPrincipalName), \r\n TargetResourceName = tolower(tostring(TargetResources[0].displayName))\r\n | project TimeGenerated, AccountType, Account, Computer = TargetResourceName, Type),\r\n (//OfficeActive ActiveDirectory Password reset events\r\n OfficeActivity\r\n | where OfficeWorkload == \"AzureActiveDirectory\" \r\n | where (ExtendedProperties has_any (pWord) or ModifiedProperties has_any (pWord)) and (ExtendedProperties has_any (action) or ModifiedProperties has_any (action))\r\n | extend AccountType = UserType, Account = OfficeObjectId \r\n | project TimeGenerated, AccountType, Account, Type, Computer = \"\"),\r\n (// Unix syslog password reset events\r\n Syslog\r\n | where Facility in (\"auth\", \"authpriv\")\r\n | where SyslogMessage has_any (pWord) and SyslogMessage has_any (action)\r\n | extend AccountType = iif(SyslogMessage contains \"root\", \"Root\", \"Non-Root\")\r\n | parse SyslogMessage with * \"password changed for\" Account\r\n | project TimeGenerated, AccountType, Account, Computer = HostName, Type),\r\n (SigninLogs\r\n | where OperationName =~ \"Sign-in activity\" and ResultType has_any (\"50125\", \"50133\")\r\n | project TimeGenerated, AccountType = AppDisplayName, Computer = IPAddress, Account = UserPrincipalName, Type\r\n )\r\n );\r\nlet pwrmd = PasswordResetMultiDataSource\r\n | project TimeGenerated, Computer, AccountType, Account, Type;\r\n(union isfuzzy=true \r\n (pwrmd\r\n | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Computer = makeset(Computer), AccountType = makeset(AccountType), Total=count() by Account, Type\r\n | where Total > PerUserThreshold\r\n | extend ResetPivot = \"PerUserReset\"), \r\n (pwrmd\r\n | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Computer = makeset(Computer), Account = tostring(makeset(Account)), AccountType = makeset(AccountType), Total=count() by Type\r\n | where Total > TotalThreshold\r\n | extend ResetPivot = \"TotalUserReset\")\r\n)\r\n| extend timestamp = StartTimeUtc, AccountCustomEntity = Account, HostCustomEntity = tostring(Computer)\r\n| where AccountCustomEntity in ({UserPrincipalName})\r\n| summarize count() by AccountCustomEntity\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Multiple Password Resets", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AccountCustomEntity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } } ], "filter": true } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results106", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results106", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let current = 1d;\r\nlet auditLookback = {TimeRange:grain};\r\nlet propertyIgnoreList = dynamic([\"TargetId.UserType\", \"StsRefreshTokensValidFrom\", \"LastDirSyncTime\", \"DeviceOSVersion\", \"CloudDeviceOSVersion\", \"DeviceObjectVersion\"]);\r\nlet AuditTrail = AuditLogs\r\n | where TimeGenerated >= ago(auditLookback) and TimeGenerated < ago(current)\r\n | where isnotempty(tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName))\r\n | extend InitiatedByUser = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)\r\n | extend InitiatedByIPAddress = tostring(parse_json(tostring(InitiatedBy.user)).ipAddress)\r\n | extend ModProps = TargetResources.[0].modifiedProperties\r\n | extend TargetUserPrincipalName = tolower(tostring(TargetResources.[0].userPrincipalName))\r\n | extend TargetResourceName = tolower(tostring(TargetResources.[0].displayName))\r\n | mv-expand ModProps\r\n | extend PropertyName = tostring(ModProps.displayName), newValue = tostring(parse_json(tostring(ModProps.newValue))[0])\r\n | where PropertyName !in~ (propertyIgnoreList) and (PropertyName !~ \"Action Client Name\" and newValue !~ \"DirectorySync\") and (PropertyName !~ \"Included Updated Properties\" and newValue !~ \"LastDirSyncTime\")\r\n | summarize count() by OperationName, InitiatedByUser, InitiatedByIPAddress, TargetUserPrincipalName, PropertyName, TargetResourceName;\r\nlet AccountMods = AuditLogs \r\n | where TimeGenerated >= ago(current)\r\n | where isnotempty(tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName))\r\n | extend InitiatedByUser = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)\r\n | extend InitiatedByIPAddress = tostring(parse_json(tostring(InitiatedBy.user)).ipAddress)\r\n | extend ModProps = TargetResources.[0].modifiedProperties\r\n | extend TargetUserPrincipalName = tolower(tostring(TargetResources.[0].userPrincipalName))\r\n | extend TargetResourceName = tolower(tostring(TargetResources.[0].displayName))\r\n | mv-expand ModProps\r\n | extend PropertyName = tostring(ModProps.displayName), newValue = tostring(parse_json(tostring(ModProps.newValue))[0])\r\n | where PropertyName !in~ (propertyIgnoreList) and (PropertyName !~ \"Action Client Name\" and newValue !~ \"DirectorySync\") and (PropertyName !~ \"Included Updated Properties\" and newValue !~ \"LastDirSyncTime\")\r\n | extend ModifiedProps = pack(\"PropertyName\", PropertyName, \"newValue\", newValue, \"Id\", Id, \"CorrelationId\", CorrelationId) \r\n | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Activity = make_bag(ModifiedProps) by Type, InitiatedByUser, InitiatedByIPAddress, TargetUserPrincipalName, Category, OperationName, PropertyName, TargetResourceName;\r\nlet RareAudits = AccountMods\r\n | join kind= leftanti (\r\n AuditTrail \r\n )\r\n on OperationName, InitiatedByUser, InitiatedByIPAddress;//, TargetUserPrincipalName, PropertyName; //uncomment if you want to see Rare Property changes to a given TargetUserPrincipalName.\r\nRareAudits \r\n| summarize StartTime = min(StartTimeUtc), EndTime = max(EndTimeUtc), make_set(Activity), make_set(PropertyName) by Type, InitiatedByUser, InitiatedByIPAddress, OperationName, TargetUserPrincipalName, TargetResourceName\r\n| extend timestamp = StartTime, AccountCustomEntity = InitiatedByUser, HostCustomEntity = iff(set_PropertyName has_any ('DeviceOSType', 'CloudDeviceOSType'), TargetResourceName, ''), IPCustomEntity = InitiatedByIPAddress\r\n| where AccountCustomEntity in ({UserPrincipalName})\r\n| distinct AccountCustomEntity, OperationName, StartTime\r\n| sort by StartTime desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Rare Audit Activity Initiated", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AccountCustomEntity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "pending", "text": "{0}{1}" } ] } }, { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ], "filter": true } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results107", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results107", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let auditLookback = {TimeRange:grain};\r\n// Setting threshold to 3 as a default, change as needed. Any operation that has been initiated by a user or app more than 3 times in the past 30 days will be exluded\r\nlet threshold = 3;\r\n// Helper function to extract relevant fields from AuditLog events\r\nlet auditLogEvents = view (startTimeSpan: timespan) {\r\n AuditLogs\r\n | where TimeGenerated >= ago(auditLookback)\r\n | extend ModProps = TargetResources.[0].modifiedProperties\r\n | extend IpAddress = iff(isnotempty(tostring(parse_json(tostring(InitiatedBy.user)).ipAddress)), \r\n tostring(parse_json(tostring(InitiatedBy.user)).ipAddress), tostring(parse_json(tostring(InitiatedBy.app)).ipAddress))\r\n | extend InitiatedBy = iff(isnotempty(tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)), \r\n tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName), tostring(parse_json(tostring(InitiatedBy.app)).displayName))\r\n | extend TargetResourceName = tolower(tostring(TargetResources.[0].displayName))\r\n | mvexpand ModProps\r\n | extend PropertyName = tostring(ModProps.displayName), newValue = replace('\\\"', \"\", tostring(ModProps.newValue));\r\n};\r\n// Get just the InitiatedBy and CorrleationId so we can look at associated audit activity\r\n// 2 other operations that can be part of malicious activity in this situation are \r\n// \"Add OAuth2PermissionGrant\" and \"Add service principal\", replace the below if you are interested in those as starting points for OperationName\r\nlet HistoricalConsent = auditLogEvents(auditLookback) \r\n | where OperationName == \"Consent to application\"\r\n | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), OperationCount = count() \r\n by Type, InitiatedBy, IpAddress, TargetResourceName, Category, OperationName, PropertyName, newValue, CorrelationId, Id\r\n// Remove comment below to only include operations initiated by a user or app that is above the threshold for the last 30 days\r\n//| where OperationCount > threshold\r\n;\r\nlet Correlate = HistoricalConsent \r\n | summarize by InitiatedBy, CorrelationId;\r\n// 2 other operations that can be part of malicious activity in this situation are \r\n// \"Add OAuth2PermissionGrant\" and \"Add service principal\", replace the below if you changed the starting OperationName above\r\nlet allOtherEvents = auditLogEvents(auditLookback) \r\n | where OperationName != \"Consent to application\";\r\n// Gather associated activity based on audit activity for \"Consent to application\" and InitiatedBy and CorrleationId\r\nlet CorrelatedEvents = Correlate \r\n | join allOtherEvents on InitiatedBy, CorrelationId\r\n | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) \r\n by Type, InitiatedBy, IpAddress, TargetResourceName, Category, OperationName, PropertyName, newValue, CorrelationId, Id\r\n;\r\n// Union the results\r\nlet Results = union isfuzzy=true HistoricalConsent, CorrelatedEvents;\r\n// newValues that are simple semi-colon separated, make those dynamic for easy viewing and Aggregate into the PropertyUpdate set based on CorrelationId and Id(DirectoryId)\r\nResults\r\n| extend newValue = split(newValue, \";\")\r\n| extend PropertyUpdate = pack(PropertyName, newValue, \"Id\", Id)\r\n// Extract scope requested\r\n| extend perms = tostring(parse_json(tostring(PropertyUpdate.[\"ConsentAction.Permissions\"]))[0])\r\n| extend scope = extract('Scope:\\\\s*([^,\\\\]]*)', 1, perms)\r\n// Filter out some common openid, and low privilege request scopes - uncomment line below to filter out where no scope is requested\r\n//| where isnotempty(scope)\r\n| where scope !contains 'openid' and scope !in ('user_impersonation', 'User.Read')\r\n| summarize StartTime = min(StartTimeUtc), EndTime = max(EndTimeUtc), PropertyUpdateSet = make_bag(PropertyUpdate), make_set(scope)\r\n by InitiatedBy, IpAddress, TargetResourceName, OperationName, CorrelationId\r\n| extend timestamp = StartTime, AccountCustomEntity = InitiatedBy, IPCustomEntity = IpAddress\r\n| where AccountCustomEntity in ({UserPrincipalName})\r\n| summarize count() by AccountCustomEntity\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Consent to Application Discovery", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ] } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results108", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results108", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let auditLookback = {TimeRange:grain};\r\nlet opName = dynamic([\"Add user\", \"Invite external user\"]);\r\n// Helper function to extract relevant fields from AuditLog events\r\nlet auditLogEvents = view (startTimeSpan: timespan, operation: dynamic) {\r\n AuditLogs\r\n | where TimeGenerated >= ago(auditLookback)\r\n | where OperationName in~ (operation)\r\n | extend ModProps = iff(TargetResources.[0].modifiedProperties != \"[]\", TargetResources.[0].modifiedProperties, todynamic(\"NoValues\"))\r\n | extend IpAddress = iff(isnotempty(tostring(parse_json(tostring(InitiatedBy.user)).ipAddress)), \r\n tostring(parse_json(tostring(InitiatedBy.user)).ipAddress), tostring(parse_json(tostring(InitiatedBy.app)).ipAddress))\r\n | extend InitiatedByFull = iff(isnotempty(tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)), \r\n tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName), tostring(parse_json(tostring(InitiatedBy.app)).displayName))\r\n | extend InitiatedBy = replace(\"_\", \"@\", tostring(split(InitiatedByFull, \"#\")[0]))\r\n | extend TargetUserPrincipalName = tostring(TargetResources[0].userPrincipalName)\r\n | extend TargetUserName = replace(\"_\", \"@\", tostring(split(TargetUserPrincipalName, \"#\")[0]))\r\n | extend TargetResourceName = case(\r\n isempty(tostring(TargetResources.[0].displayName)), TargetUserPrincipalName,\r\n isnotempty(tostring(TargetResources.[0].displayName)) and tostring(TargetResources.[0].displayName) startswith \"upn:\", tolower(tostring(TargetResources.[0].displayName)),\r\n tolower(tostring(TargetResources.[0].displayName))\r\n )\r\n | extend TargetUserName = replace(\"_\", \"@\", tostring(split(TargetUserPrincipalName, \"#\")[0]))\r\n | extend TargetUserName = iff(isempty(TargetUserName), tostring(split(split(TargetResourceName, \",\")[0], \" \")[1]), TargetUserName) \r\n | mvexpand ModProps\r\n | extend PropertyName = tostring(ModProps.displayName), newValue = replace('\\\"', '', tostring(ModProps.newValue));\r\n};\r\n// Assigning time for First TargetUserName that was added\r\nlet FirstAdd = auditLogEvents(auditLookback, opName) \r\n | project FirstAddTimeUtc = TimeGenerated, Type, FirstInitiatedBy = InitiatedBy, IpAddress, FirstTargetUserName = TargetUserName, FirstTargetResourceName = TargetResourceName, \r\n FirstOperationName = OperationName, FirstPropertyName = PropertyName, FirstnewValue = newValue, FirstCorrelationId = CorrelationId, FirstId = Id;\r\n// Assigning time for second TargetUserName that was added, which will allow us to see if a first TargetUserName added in is the Initiated by on the second in the later join\r\nlet SecondAdd = auditLogEvents(auditLookback, opName) \r\n | project SecondAddTimeUtc = TimeGenerated, Type, SecondInitiatedBy = InitiatedBy, IpAddress, SecondTargetUserName = TargetUserName, SecondTargetResourceName = TargetResourceName, \r\n SecondOperationName = OperationName, SecondPropertyName = PropertyName, SecondnewValue = newValue, SecondCorrelationId = CorrelationId, SecondId = Id;\r\n// Joining the FirstAdd with SecondAdd where the FirstAdd TargetUserName value matches the SecondAdd InitiatedBy. This shows the new user adding a user.\r\nlet NewUserAddsUser = FirstAdd\r\n | join SecondAdd on $left.FirstTargetUserName == $right.SecondInitiatedBy\r\n // we only want items where the FirstAddTimeUtc is before the SecondAddTimeUtc\r\n | where FirstAddTimeUtc < SecondAddTimeUtc\r\n;\r\n// Build out some of the properties for context\r\nNewUserAddsUser\r\n| extend FirstnewValue = split(FirstnewValue, \";\"), SecondnewValue = split(SecondnewValue, \";\")\r\n| extend PropertyUpdate = pack(FirstPropertyName, FirstnewValue, SecondPropertyName, SecondnewValue, \"FirstCorrelationId\", FirstCorrelationId, \"FirstId\", FirstId, \"SecondCorrelationId\", SecondCorrelationId, \"SecondId\", SecondId)\r\n| summarize PropertyUpdateSet = make_bag(PropertyUpdate)\r\n by FirstAddTimeUtc, FirstInitiatedBy, FirstTargetUserName, SecondAddTimeUtc, SecondInitiatedBy, SecondTargetUserName, \r\n IpAddress, FirstTargetResourceName, SecondTargetResourceName, FirstOperationName, SecondOperationName\r\n| extend timestamp = FirstAddTimeUtc, AccountCustomEntity = FirstInitiatedBy, HostCustomEntity = FirstTargetResourceName, IPCustomEntity = IpAddress\r\n| where AccountCustomEntity in ({UserPrincipalName})\r\n| summarize count() by AccountCustomEntity\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Granted Access and Grants Others Access", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ] } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results109", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results109", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Provide customLimit value with default above domainLimit value so it will not block unless changed\r\nlet customLimit = 11;\r\nlet domainLimit = 10;\r\nlet domainLookback = union isfuzzy=true\r\n (AuditLogs\r\n | extend UserPrincipalName = tolower(tostring(TargetResources.[0].userPrincipalName))\r\n // parse out AuditLog values for various locations where UPN could be\r\n | extend UserPrincipalName = iff(isnotempty(UserPrincipalName),\r\n UserPrincipalName, \r\n iif((tostring(InitiatedBy.user.userPrincipalName) == 'unknown'), \r\n extract(\"Email: ([a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\\\\.[a-zA-Z0-9-.]+)\", 1, tostring(parse_json(TargetResources)[0].displayName)), \r\n InitiatedBy.user.userPrincipalName))\r\n | where UserPrincipalName has \"@\" or UserPrincipalName startswith \"NT AUTHORITY\"\r\n | extend RareDomain = toupper(tostring(split(UserPrincipalName, \"@\")[-1]))\r\n | where isnotempty(RareDomain) \r\n | summarize RareDomainCount = count() by Type, RareDomain\r\n | where RareDomainCount <= domainLimit\r\n | extend AccountCustomEntity = UserPrincipalName\r\n // remove comment from below if you would like to have a lower limit for RareDomainCount specific to AuditLog\r\n //| where RareDomainCount <= customLimit\r\n ),\r\n (OfficeActivity\r\n | extend UserPrincipalName = tolower(UserId)\r\n | where UserPrincipalName has \"@\" or UserPrincipalName startswith \"NT AUTHORITY\"\r\n | extend RareDomain = toupper(tostring(split(UserPrincipalName, \"@\")[-1]))\r\n | summarize RareDomainCount = count() by Type, RareDomain\r\n | where RareDomainCount <= domainLimit\r\n | extend AccountCustomEntity = UserPrincipalName\r\n // remove comment from below if you would like to have a lower limit for RareDomainCount specific to OfficeActivity\r\n //| where RareDomainCount <= customLimit\r\n ),\r\n (SigninLogs\r\n | where UserPrincipalName has \"@\" or UserPrincipalName startswith \"NT AUTHORITY\"\r\n | extend RareDomain = toupper(tostring(split(UserPrincipalName, \"@\")[-1]))\r\n | summarize RareDomainCount = count() by Type, RareDomain\r\n | where RareDomainCount <= domainLimit\r\n // remove comment from below if you would like to have a lower limit for RareDomainCount specific to SigninLogs\r\n //| where RareDomainCount <= customLimit\r\n );\r\nlet AuditLogsRef = domainLookback\r\n | join (\r\n AuditLogs\r\n | extend UserPrincipalName = tolower(tostring(TargetResources.[0].userPrincipalName))\r\n | extend UserPrincipalName = iff(isempty(UserPrincipalName), tostring(InitiatedBy.user.userPrincipalName), UserPrincipalName)\r\n | extend RareDomain = toupper(tostring(split(UserPrincipalName, \"@\")[-1]))\r\n | where isnotempty(RareDomain) \r\n | summarize UPNRefCount = count() by TimeGenerated, Type, RareDomain, UserPrincipalName, OperationName, Category, Result\r\n | extend AccountCustomEntity = UserPrincipalName\r\n )\r\n on Type, RareDomain;\r\nlet OfficeActivityRef = domainLookback\r\n | join (\r\n OfficeActivity\r\n | extend UserPrincipalName = tolower(UserId)\r\n | where UserPrincipalName has \"@\" or UserPrincipalName startswith \"NT AUTHORITY\"\r\n | extend RareDomain = toupper(tostring(split(UserPrincipalName, \"@\")[-1]))\r\n | summarize UPNRefCount = count() by TimeGenerated, Type, RareDomain, UserPrincipalName, OperationName = Operation, Category = OfficeWorkload, Result = ResultStatus\r\n | extend AccountCustomEntity = UserPrincipalName\r\n )\r\n on Type, RareDomain;\r\nlet SigninLogsRef = domainLookback\r\n | join (\r\n SigninLogs\r\n | extend UserPrincipalName = tolower(UserId)\r\n | where UserPrincipalName has \"@\" or UserPrincipalName startswith \"NT AUTHORITY\"\r\n | extend RareDomain = toupper(tostring(split(UserPrincipalName, \"@\")[-1]))\r\n | summarize UPNRefCount = count() by TimeGenerated, Type, RareDomain, UserPrincipalName, OperationName, Category = AppDisplayName, Result = ResultType\r\n | extend AccountCustomEntity = UserPrincipalName\r\n )\r\n on Type, RareDomain;\r\nlet Results = union isfuzzy=true\r\n AuditLogsRef, OfficeActivityRef, SigninLogsRef;\r\nResults\r\n| project TimeGenerated, Type, RareDomain, UserPrincipalName, OperationName, Category, Result, UPNRefCount \r\n| order by TimeGenerated asc \r\n| extend timestamp = TimeGenerated, AccountCustomEntity = UserPrincipalName\r\n| where AccountCustomEntity in ({UserPrincipalName})\r\n| summarize count() by AccountCustomEntity\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Rare Domains Observed in User Cloud Logs", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ] } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results110", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results110", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let auditLookback = {TimeRange:grain};\r\nlet opName = dynamic([\"Add user\", \"Invite external user\"]);\r\n// Helper function to extract relevant fields from AuditLog events\r\nlet auditLogEvents = view (startTimeSpan: timespan, operation: dynamic) {\r\n AuditLogs\r\n | where TimeGenerated >= ago(auditLookback)\r\n | where OperationName in~ (operation)\r\n | extend UserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)\r\n | where UserPrincipalName in ({UserPrincipalName})\r\n | extend ModProps = iff(TargetResources.[0].modifiedProperties != \"[]\", TargetResources.[0].modifiedProperties, todynamic(\"NoValues\"))\r\n | extend IpAddress = iff(isnotempty(tostring(parse_json(tostring(InitiatedBy.user)).ipAddress)), \r\n tostring(parse_json(tostring(InitiatedBy.user)).ipAddress), tostring(parse_json(tostring(InitiatedBy.app)).ipAddress))\r\n | extend InitiatedByFull = iff(isnotempty(tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)), \r\n tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName), tostring(parse_json(tostring(InitiatedBy.app)).displayName))\r\n | extend InitiatedBy = replace(\"_\", \"@\", tostring(split(InitiatedByFull, \"#\")[0]))\r\n | extend TargetUserPrincipalName = tostring(TargetResources[0].userPrincipalName)\r\n | extend TargetUserName = replace(\"_\", \"@\", tostring(split(TargetUserPrincipalName, \"#\")[0]))\r\n | extend TargetResourceName = case(\r\n isempty(tostring(TargetResources.[0].displayName)), TargetUserPrincipalName,\r\n isnotempty(tostring(TargetResources.[0].displayName)) and tostring(TargetResources.[0].displayName) startswith \"upn:\", tolower(tostring(TargetResources.[0].displayName)),\r\n tolower(tostring(TargetResources.[0].displayName))\r\n )\r\n | extend TargetUserName = replace(\"_\", \"@\", tostring(split(TargetUserPrincipalName, \"#\")[0]))\r\n | extend TargetUserName = iff(isempty(TargetUserName), tostring(split(split(TargetResourceName, \",\")[0], \" \")[1]), TargetUserName) \r\n | mvexpand ModProps\r\n | extend PropertyName = tostring(ModProps.displayName), newValue = replace(\"\\\"\", \"\", tostring(ModProps.newValue));\r\n};\r\nlet UserAdd = auditLogEvents(auditLookback, opName) \r\n | project Action = \"User Added\", TimeGenerated, Type, InitiatedBy_Caller = InitiatedBy, IpAddress, TargetUserName = tolower(TargetUserName), OperationName, PropertyName_ResourceId = PropertyName, Value = newValue;\r\n// Get the simple list of creatd users so we can use later to get just the associated resource creation events\r\nlet SimpleUserList = UserAdd\r\n | project TimeGenerated, TargetUserName;\r\nlet ResourceCreation = AzureActivity\r\n | where TimeGenerated >= ago(auditLookback)\r\n // We look for any Operation that created and then succeeded where ActivityStatus has a value so that we can provide context\r\n | where OperationName has \"Create\"\r\n | where ActivityStatus has \"Succeeded\"\r\n | project Action = \"Resource Created\", ResourceCreationTimeGenerated = TimeGenerated, Type, InitiatedBy_Caller = tolower(Caller), IpAddress = CallerIpAddress, OperationName, Value = OperationNameValue, PropertyName_ResourceId = ResourceId;\r\n// Get just the Resources added by the new user\r\nlet ResourceMatch = SimpleUserList\r\n | join kind= innerunique (\r\n ResourceCreation\r\n )\r\n on $left.TargetUserName == $right.InitiatedBy_Caller\r\n // where the resource creation is after (greater than) the user addition\r\n | where TimeGenerated < ResourceCreationTimeGenerated\r\n | project-away TimeGenerated \r\n | project-rename TimeGenerated = ResourceCreationTimeGenerated\r\n;\r\nlet SimpleResourceMatch = ResourceMatch\r\n | project InitiatedBy_Caller;\r\n// Get only resource add, remove, change by the new user\r\nlet UserAddWithResource = SimpleResourceMatch\r\n | join kind= rightsemi (\r\n UserAdd \r\n )\r\n on $left.InitiatedBy_Caller == $right.TargetUserName;\r\n// union the user addition events and resource addition events and provide common column names, additionally pack the value, property and resource info to reduce result set.\r\nUserAddWithResource \r\n| union isfuzzy=true ResourceMatch\r\n| extend PropertySet = pack(\"Value\", Value, \"PropertyName_ResourceId\", PropertyName_ResourceId) \r\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), makeset(PropertySet) by Action, Type, TargetUserName, InitiatedBy_Caller, IpAddress, OperationName\r\n| order by StartTimeUtc asc \r\n| extend timestamp = StartTimeUtc, AccountCustomEntity = TargetUserName, IPCustomEntity = IpAddress\r\n| summarize count() by AccountCustomEntity\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Granted Access and Creates Resources", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ] } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results111", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results111", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "(union isfuzzy=true\r\n(\r\nAuditLogs\r\n| extend UserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)\r\n| where OperationName =~ \"Set federation settings on domain\"\r\n//| where Result =~ \"success\" // commenting out, as it may be interesting to capture failed attempts\r\n| mv-expand TargetResources\r\n| extend modifiedProperties = parse_json(TargetResources).modifiedProperties\r\n| mv-expand modifiedProperties\r\n| extend targetDisplayName = tostring(parse_json(modifiedProperties).displayName)\r\n| mv-expand AdditionalDetails\r\n),\r\n(\r\nAuditLogs\r\n| where OperationName =~ \"Set domain authentication\"\r\n//| where Result =~ \"success\" // commenting out, as it may be interesting to capture failed attempts\r\n| mv-expand TargetResources\r\n| extend modifiedProperties = parse_json(TargetResources).modifiedProperties\r\n| mv-expand modifiedProperties\r\n| extend targetDisplayName = tostring(parse_json(modifiedProperties).displayName), NewDomainValue=tostring(parse_json(modifiedProperties).newValue)\r\n| where NewDomainValue has \"Federated\"\r\n))\r\n| where UserPrincipalName in ({UserPrincipalName})\r\n| summarize count() by UserPrincipalName\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Modified Domain Federation Trust Settings", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "Operation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "OfficeWorkload", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } } ] } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results112", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results112", "styleSettings": { "maxWidth": "50" } } ] }, "conditionalVisibility": { "parameterName": "isAuditLogsVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Audit Logs Group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "7afa304d-b448-4d6c-8c54-69e51a7249a9", "version": "KqlParameterItem/1.0", "name": "Results140", "type": 1, "query": "LAQueryLogs\r\n| where AADEmail in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results140", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "f7512a90-bfac-4655-87a9-693c0dd1a96e", "version": "KqlParameterItem/1.0", "name": "Results141", "type": 1, "query": "let lookback = {TimeRange:grain};\r\nlet threshold = 0;\r\nLAQueryLogs\r\n| make-series rows = sum(ResponseRowCount) on TimeGenerated in range(startofday(ago(lookback)), now(), 1h)\r\n| extend (anomalies, score, baseline) = series_decompose_anomalies(rows,3, -1, 'linefit')\r\n| mv-expand anomalies to typeof(int), score to typeof(double), TimeGenerated to typeof(datetime)\r\n| where anomalies > threshold\r\n| sort by score desc\r\n| join kind=rightsemi (\r\nLAQueryLogs\r\n| summarize make_set(QueryText) by AADEmail, RequestTarget, TimeGenerated = bin(TimeGenerated, 1h))\r\non TimeGenerated\r\n| project TimeGenerated, AADEmail, RequestTarget, set_QueryText\r\n| where AADEmail in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results141", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "b14b7da1-9438-403b-ab3f-f437b84b3121", "version": "KqlParameterItem/1.0", "name": "Results142", "type": 1, "query": "let lookback = {TimeRange:grain};\r\nlet timeframe = 1h;\r\nlet threshold = 3;\r\nLAQueryLogs\r\n| where TimeGenerated > ago(lookback)\r\n| where ResponseCode != 200\r\n| summarize count() by AADEmail, bin(TimeGenerated, timeframe)\r\n| where count_ > threshold\r\n| join kind=rightsemi (\r\nLAQueryLogs\r\n| where TimeGenerated > ago(lookback)\r\n| summarize make_set(QueryText) by AADEmail, bin(TimeGenerated, timeframe))\r\non AADEmail, TimeGenerated\r\n| where AADEmail in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Results142", "styleSettings": { "maxWidth": "0" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "969178cb-490d-442b-ae0d-b62a5dc0b66d", "version": "KqlParameterItem/1.0", "name": "Results143", "type": 1, "query": "let UI_apps = dynamic(['ASI_Portal','AzureMonitorLogsConnector','AppAnalytics']);\r\nlet threshold = 3;\r\nLAQueryLogs\r\n| where (ResponseRowCount == 5000 and RequestClientApp in(UI_apps)) or (ResponseRowCount > 5000 and RequestClientApp !in(UI_apps))\r\n| summarize count() by AADEmail\r\n| where count_ > threshold\r\n| join kind=rightsemi (\r\nLAQueryLogs\r\n| where (ResponseRowCount == 5000 and RequestClientApp in(UI_apps)) or (ResponseRowCount > 5000 and RequestClientApp !in(UI_apps)))\r\non AADEmail\r\n| where AADEmail in ({UserPrincipalName})\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "Results143" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Log Queries](https://docs.microsoft.com/azure/azure-monitor/logs/query-audit)\n---\n\nQuery auditing is enabled with a diagnostic setting on the Log Analytics workspace. This allows you to send audit data to the current workspace or any other workspace in your subscription, to Azure Event Hubs to send outside of Azure, or to Azure Storage for archiving. Log query audit logs provide telemetry about log queries run in Azure Monitor. This includes information such as when a query was run, who ran it, what tool was used, the query text, and performance statistics describing the query's execution.\n\n\n\n" }, "name": "text - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "4a388baf-b1ed-4d69-9b31-58039271c260", "linkTarget": "OpenBlade", "linkLabel": "Azure Monitor >>", "style": "secondary", "bladeOpenContext": { "bladeName": "AzureMonitoringBrowseBlade", "extensionName": "Microsoft_Azure_Monitoring", "bladeParameters": [] } } ] }, "customWidth": "50", "name": "EL0" } ] }, "customWidth": "40", "name": "group - 11" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 10" }, { "type": 1, "content": { "json": "| Log Queries | - |\r\n|:--| :--|\r\n| Log Analytics Query Logs | Query Data Volume Anomalies | \r\n| Multiple Failed Queries | User Multiple Large Queries |\r\n\r\nThis section is bound by the above parameters for Subscription, Workspace, TimeRange, and User. Panels are dynamically displayed meaning numerous queries are executed and only panels returning data are displayed." }, "customWidth": "40", "name": "SI OV" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "LAQueryLogs\r\n| where AADEmail in ({UserPrincipalName})\r\n| summarize count() by AADEmail, QueryText\r\n| sort by count_ desc\r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "Log Analytics Query Logs", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AADEmail", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "QueryText", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "blue" } } ], "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results140", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results140b", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lookback = {TimeRange:grain};\r\nlet threshold = 0;\r\nLAQueryLogs\r\n| make-series rows = sum(ResponseRowCount) on TimeGenerated in range(startofday(ago(lookback)), now(), 1h)\r\n| extend (anomalies, score, baseline) = series_decompose_anomalies(rows,3, -1, 'linefit')\r\n| mv-expand anomalies to typeof(int), score to typeof(double), TimeGenerated to typeof(datetime)\r\n| where anomalies > threshold\r\n| sort by score desc\r\n| join kind=rightsemi (\r\nLAQueryLogs\r\n| summarize make_set(QueryText) by AADEmail, RequestTarget, TimeGenerated = bin(TimeGenerated, 1h))\r\non TimeGenerated\r\n| project TimeGenerated, AADEmail, RequestTarget, set_QueryText\r\n| where AADEmail in ({UserPrincipalName})\r\n| summarize count() by AADEmail\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Query Data Volume Anomalies", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AADEmail", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "QueryText", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "down", "text": "{0}{1}" } ] } } ], "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results141", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results141", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let lookback = {TimeRange:grain};\r\nlet timeframe = 1h;\r\nlet threshold = 3;\r\nLAQueryLogs\r\n| where TimeGenerated > ago(lookback)\r\n| where ResponseCode != 200\r\n| summarize count() by AADEmail, bin(TimeGenerated, timeframe)\r\n| where count_ > threshold\r\n| join kind=rightsemi (\r\nLAQueryLogs\r\n| where TimeGenerated > ago(lookback)\r\n| summarize make_set(QueryText) by AADEmail, bin(TimeGenerated, timeframe))\r\non AADEmail, TimeGenerated\r\n| where AADEmail in ({UserPrincipalName})\r\n| summarize count() by AADEmail\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Multiple Failed Queries", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AADEmail", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "QueryText", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "down", "text": "{0}{1}" } ] } } ], "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results142", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results142", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let UI_apps = dynamic(['ASI_Portal','AzureMonitorLogsConnector','AppAnalytics']);\r\nlet threshold = 3;\r\nLAQueryLogs\r\n| where (ResponseRowCount == 5000 and RequestClientApp in(UI_apps)) or (ResponseRowCount > 5000 and RequestClientApp !in(UI_apps))\r\n| summarize count() by AADEmail\r\n| where count_ > threshold\r\n| join kind=rightsemi (\r\nLAQueryLogs\r\n| where (ResponseRowCount == 5000 and RequestClientApp in(UI_apps)) or (ResponseRowCount > 5000 and RequestClientApp !in(UI_apps)))\r\non AADEmail\r\n| where AADEmail in ({UserPrincipalName})\r\n| summarize count() by AADEmail\r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Multiple Large Queries", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AADEmail", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "resource", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "QueryText", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "down", "text": "{0}{1}" } ] } } ], "filter": true }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results143", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results143", "styleSettings": { "maxWidth": "50" } } ] }, "conditionalVisibility": { "parameterName": "isLogQueriesVisible", "comparison": "isEqualTo", "value": "true" }, "name": "User Log Queries Group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Data Loss Prevention](https://docs.microsoft.com/microsoft-365/solutions/information-protection-deploy)\n---\n\nYour organization may be subject to regional data privacy regulations that require you to protect, manage, and provide rights and control over personal information stored in your IT infrastructure, including both on-premises and in the cloud. The best example of a data privacy regulation is the European Union's General Data Protection Regulation (GDPR). Failure to comply with data privacy regulations can result in substantial fines.\n\nExamples of the types of data in Microsoft 365 include chat sessions in Microsoft Teams, emails in Exchange, and files in SharePoint and OneDrive. This solution provides guidance on how to assess risks and take appropriate action to protect personal data in Microsoft 365. This includes identifying personal information so you can protect, govern, and respond to data privacy incidents.
\n\n\n\n" }, "customWidth": "40", "name": "text - 2" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 12" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "1cf637a7-121d-4722-b511-b0c460625e31", "linkTarget": "OpenBlade", "linkLabel": "Azure Information Protection >>", "postText": "", "style": "secondary", "bladeOpenContext": { "bladeName": "DataClassGroupEditBlade", "extensionName": "Microsoft_Azure_InformationProtection", "bladeParameters": [] } } ] }, "customWidth": "50", "name": "links - 3" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "7afa304d-b448-4d6c-8c54-69e51a7249a9", "version": "KqlParameterItem/1.0", "name": "Results305", "type": 1, "query": "SecurityAlert\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n| extend Href_ = tostring(parse_json(ExtendedLinks)[0].Href)\r\n| extend UserPrincipalName = UPN\r\n| distinct AlertName, ProductName, Status, AlertLink, UserPrincipalName, Tactics, TimeGenerated\r\n| where AlertName contains \"sensitive\" or AlertName contains \"data\" or AlertName contains \"leak\" or Tactics contains \"exfil\" or AlertName contains \"theft\" or AlertName contains \"steal\" or AlertName contains \"PII\" or AlertName contains \"intellectual\" or AlertName contains \"confidential\" or AlertName contains \"spill\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "10", "name": "Results305", "styleSettings": { "maxWidth": "10" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "04a06f0b-7190-4af9-9d04-473d54a3f923", "version": "KqlParameterItem/1.0", "name": "Results306", "type": 1, "query": "MicrosoftPurviewInformationProtection\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "10", "name": "Results306", "styleSettings": { "maxWidth": "10" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "84d1a90a-923f-4fe1-88a0-b5603f0530b6", "version": "KqlParameterItem/1.0", "name": "Results307", "type": 1, "query": "MicrosoftPurviewInformationProtection\r\n| extend UserPrincipalName = UserId\r\n| where LabelName <> \"\"\r\n| join (SigninLogs) on UserPrincipalName\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "Results307" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MicrosoftPurviewInformationProtection\r\n| extend UserPrincipalName = UserId\r\n| where LabelName <> \"\"\r\n| join (SigninLogs) on UserPrincipalName\r\n| extend City = tostring(LocationDetails.city)\r\n| extend State = tostring(LocationDetails.state)\r\n| extend Country_Region = tostring(LocationDetails.countryOrRegion)\r\n", "size": 3, "showAnalytics": true, "title": "Sensitive Data Access by Geolocation", "noDataMessage": "There are no results within the selected thresholds (time, workspace, subscription). See Enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel for respective UEBA configurations (https://docs.microsoft.com/azure/sentinel/enable-entity-behavior-analytics)", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "map", "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "warning", "text": "{0}{1}" } ] } }, { "columnMatch": "UncommonActionVolume", "formatter": 4, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "UncommonAction", "formatter": 4, "formatOptions": { "palette": "green" } }, { "columnMatch": "FirstTimeUserAction", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "FirstTimeDeviceLogon", "formatter": 4, "formatOptions": { "palette": "yellow" } }, { "columnMatch": "IncidentCount", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "AlertCount", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "AnomalyCount", "formatter": 8, "formatOptions": { "palette": "yellow" } } ] }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "latitude_", "longitude": "longitude_", "sizeSettings": "Location", "sizeAggregation": "Count", "labelSettings": "city_", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "yellow" } ] } } }, "customWidth": "60", "conditionalVisibility": { "parameterName": "Results307", "comparison": "isEqualTo", "value": "Yes" }, "name": "query - 12" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MicrosoftPurviewInformationProtection\r\n| extend UserPrincipalName = UserId\r\n| where LabelName <> \"\"\r\n| join (SigninLogs) on UserPrincipalName\r\n| extend City = tostring(LocationDetails.city)\r\n| extend State = tostring(LocationDetails.state)\r\n| extend Country_Region = tostring(LocationDetails.countryOrRegion)\r\n| summarize count() by UserPrincipalName, LabelName, City, State, Country_Region\r\n| sort by count_ desc\r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "Sensitive Data Access by Geolocation Details", "noDataMessage": "There are no results within the selected thresholds (time, workspace, subscription). See Enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel for respective UEBA configurations (https://docs.microsoft.com/azure/sentinel/enable-entity-behavior-analytics)", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "LabelName_s", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Sev2", "text": "{0}{1}" } ] } }, { "columnMatch": "City", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Globe", "text": "{0}{1}" } ] } }, { "columnMatch": "State", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Globe", "text": "{0}{1}" } ] } }, { "columnMatch": "Country_Region", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Globe", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "yellow" } }, { "columnMatch": "UncommonActionVolume", "formatter": 4, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "UncommonAction", "formatter": 4, "formatOptions": { "palette": "green" } }, { "columnMatch": "FirstTimeUserAction", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "FirstTimeDeviceLogon", "formatter": 4, "formatOptions": { "palette": "yellow" } }, { "columnMatch": "IncidentCount", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "AlertCount", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "AnomalyCount", "formatter": 8, "formatOptions": { "palette": "yellow" } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "latitude_", "longitude": "longitude_", "sizeSettings": "Location", "sizeAggregation": "Count", "labelSettings": "city_", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "turquoise" } ] } } }, "customWidth": "40", "conditionalVisibility": { "parameterName": "Results307", "comparison": "isEqualTo", "value": "Yes" }, "name": "query - 12" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityAlert\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n| extend Href_ = tostring(parse_json(ExtendedLinks)[0].Href)\r\n| extend UserPrincipalName = UPN\r\n| distinct AlertName, ProductName, Status, AlertLink, UserPrincipalName, Tactics, TimeGenerated\r\n| where AlertName contains \"sensitive\" or AlertName contains \"data\" or AlertName contains \"leak\" or Tactics contains \"exfil\" or AlertName contains \"theft\" or AlertName contains \"steal\" or AlertName contains \"PII\" or AlertName contains \"intellectual\" or AlertName contains \"confidential\" or AlertName contains \"spill\"\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by AlertName\r\n| render timechart", "size": 0, "title": "Sensitive Data Leaks over Time", "noDataMessage": "There are no results within the selected thresholds (time, workspace, subscription). Confirm Security Alerts are onboarded to Microsoft Sentinel and see Getting Started with Insider Risk Management for respective IRM configurations (https://docs.microsoft.com/microsoft-365/compliance/insider-risk-management-configure)", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "3", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ProductName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Alert >" } }, { "columnMatch": "UPN", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "2", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Incident >" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "conditionalVisibility": { "parameterName": "Results305", "comparison": "isEqualTo", "value": "Yes" }, "name": "305" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityAlert\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n| extend Href_ = tostring(parse_json(ExtendedLinks)[0].Href)\r\n| extend UserPrincipalName = UPN\r\n| distinct UserPrincipalName, AlertName, ProductName, Status, AlertLink, Tactics, TimeGenerated\r\n| where AlertName contains \"sensitive\" or AlertName contains \"data\" or AlertName contains \"leak\" or Tactics contains \"exfil\" or AlertName contains \"theft\" or AlertName contains \"steal\" or AlertName contains \"PII\" or AlertName contains \"intellectual\" or AlertName contains \"confidential\" or AlertName contains \"spill\"\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "title": "Sensitive Data Leaks Alert Details", "noDataMessage": "There are no results within the selected thresholds (time, workspace, subscription). Confirm Security Alerts are onboarded to Microsoft Sentinel and see Getting Started with Insider Risk Management for respective IRM configurations (https://docs.microsoft.com/microsoft-365/compliance/insider-risk-management-configure)", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "3", "text": "{0}{1}" } ] } }, { "columnMatch": "ProductName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Alert >" } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "UPN", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "2", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Incident >" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "conditionalVisibility": { "parameterName": "Results305", "comparison": "isEqualTo", "value": "Yes" }, "name": "305b" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MicrosoftPurviewInformationProtection\r\n| extend CommonProperties = parse_json(Common)\r\n| extend ApplicationName = tostring(CommonProperties.ApplicationName)\r\n| make-series count() default=0 on TimeGenerated from todatetime('2017-09-20T21:57:00Z') to todatetime('2023-09-20T00:00:00Z') step 1d by LabelName, ApplicationName\r\n| render timechart", "size": 0, "title": "Microsoft Purview: Information Protection Document Access by Labels", "noDataMessage": "No Results, Enable Azure Information Protection Connector", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "3", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ProductName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Alert >" } }, { "columnMatch": "UPN", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "2", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Incident >" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results306", "comparison": "isEqualTo", "value": "Yes" }, "name": "306a" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MicrosoftPurviewInformationProtection\r\n| summarize count() by LabelName\r\n| render piechart", "size": 0, "title": "Microsoft Purview: Information Protection Access by Label", "noDataMessage": "No Results, Enable Azure Information Protection Connector", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "3", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ProductName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Alert >" } }, { "columnMatch": "UPN", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "2", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Incident >" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results306", "comparison": "isEqualTo", "value": "Yes" }, "name": "306b" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MicrosoftPurviewInformationProtection\r\n| extend CommonProperties = parse_json(Common)\r\n| extend ApplicationName = tostring(CommonProperties.ApplicationName)\r\n| extend properties = parse_json(ProtectionEventData)\r\n| extend ProtectionOwner = tostring(properties.ProtectionOwner)\r\n| extend IsProtected = tostring(properties.IsProtected)\r\n| distinct UserId, LabelName, ApplicationName, Operation, IsProtected, Platform, ProtectionOwner, TimeGenerated\r\n| sort by TimeGenerated desc\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Microsoft Purview: Information Protection Details", "noDataMessage": "No Results, Enable Azure Information Protection Connector", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserId_s", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "3", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ProductName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Alert >" } }, { "columnMatch": "UPN", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "2", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Incident >" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "conditionalVisibility": { "parameterName": "Results306", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results306c" } ] }, "conditionalVisibility": { "parameterName": "isDLPVisible", "comparison": "isEqualTo", "value": "true" }, "name": "DLP" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Deception](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-microsoft-sentinel-deception-solution/ba-p/2904945)\r\n\r\nInclude components within organizational systems specifically designed to be the target of malicious attacks for detecting, deflecting, and analyzing such attacks.\r\n\r\n### Recommended Logs\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/) ✳️ [Key Vault](https://azure.microsoft.com/services/key-vault/)
\r\n\r\n### Implementation\r\n💡 [Microsoft Sentinel Deception Solution](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-microsoft-sentinel-deception-solution/ba-p/2904945)
\r\n💡 [Deploy and monitor Azure Key Vault honeytokens with Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/monitor-key-vault-honeytokens?tabs=deploy-at-scale)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Key Vault](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.KeyVault%2Fvaults)
\r\n\r\n### NIST SP 800-53 Guidance\r\n[SC-26](https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/control?version=5.1&number=SC-26)
\r\n\r\n### Assessment\r\n" }, "name": "text - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatus", "label": "Status", "type": 2, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDate", "label": "Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "Notes", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{Notes}" }, "name": "text - 1" } ] }, "customWidth": "50", "name": "group - 2" } ] }, "customWidth": "50", "name": "Text Group" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where id contains \"deception\" or id contains \"honey\" or id contains \"HTDK\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc", "size": 0, "showAnalytics": true, "title": "Microsoft Sentinel: Deception Solution Assets", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "filter": true } }, "customWidth": "50", "name": "query - 1" } ] }, "conditionalVisibility": { "parameterName": "isDeceptionVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Deception", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "7afa304d-b448-4d6c-8c54-69e51a7249a9", "version": "KqlParameterItem/1.0", "name": "Results310", "type": 1, "query": "SecurityAlert\r\n| where ProviderName contains \"fusion\" or AlertName contains \"fusion\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "14", "name": "Results310", "styleSettings": { "maxWidth": "14" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "f5b358a1-f960-4260-af95-79bc72d1652f", "version": "KqlParameterItem/1.0", "name": "Results316", "type": 1, "query": "SecurityAlert\r\n| where AlertName contains \"anomal\" or ProviderName contains \"anomal\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "14", "name": "Results316", "styleSettings": { "maxWidth": "14" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "65d42fd9-6206-45ef-9730-45a75bab6335", "version": "KqlParameterItem/1.0", "name": "Results311", "type": 1, "query": "AzureActivity\r\n| where OperationName == \"Create or Update Virtual Machine\" or OperationName == \"Create Deployment\"\r\n| where ActivityStatus == \"Succeeded\"\r\n| make-series num = dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(90d), now(), 1d) by Caller\r\n| extend outliers=series_outliers(num, \"ctukey\", 0, 10, 90)\r\n| mvexpand outliers\r\n| where outliers > 0.9\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "14", "name": "Results311", "styleSettings": { "maxWidth": "14" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "f1e93b1f-2c9c-49bf-a46d-328d2cf8764d", "version": "KqlParameterItem/1.0", "name": "Results312", "type": 1, "query": "AzureActivity\r\n| where OperationName contains \"delet\" or OperationName contains \"remove\"\r\n| where ActivityStatus == \"Succeeded\"\r\n| make-series num = dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(90d), now(), 1d) by Caller\r\n| extend outliers=series_outliers(num, \"ctukey\", 0, 10, 90)\r\n| mvexpand outliers\r\n| where outliers > 0.9\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "14", "name": "Results312", "styleSettings": { "maxWidth": "14" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "806f4007-3a45-4d61-8ea0-4b77b506d125", "version": "KqlParameterItem/1.0", "name": "Results313", "type": 1, "query": "SecurityAlert\r\n| extend User_Account_ = tostring(parse_json(ExtendedProperties).[\"User Account\"])\r\n| project AlertName, ProviderName, User_Account_\r\n| evaluate basket(0.01)\r\n| project Percent, Count, AlertName, ProviderName, User_Account_\r\n| where ProviderName <> \"\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "14", "name": "Results313", "styleSettings": { "maxWidth": "14" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "eba88cfe-45c5-40d6-a14c-1cd8933282cb", "version": "KqlParameterItem/1.0", "name": "Results314", "type": 1, "query": "SecurityAlert\r\n| project AlertName, ProviderName\r\n| evaluate autocluster(0.1)\r\n| where ProviderName <> \"\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "14", "name": "Results314", "styleSettings": { "maxWidth": "14" } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "d8e8ac75-e764-4ff8-941b-bc8ad77df072", "version": "KqlParameterItem/1.0", "name": "Results315", "type": 1, "query": "SigninLogs\r\n| where RiskState == \"atRisk\"\r\n| project UserPrincipalName, Location, AppDisplayName, RiskState\r\n| evaluate basket(0.01)\r\n| where UserPrincipalName <> \"\"\r\n| where AppDisplayName <> \"\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"No\", \"Yes\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "14", "name": "Results315", "styleSettings": { "maxWidth": "14" } }, { "type": 1, "content": { "json": "# [Artificial Intelligence & Machine Learning](https://docs.microsoft.com/azure/sentinel/work-with-anomaly-rules)\r\n---\r\nMachine Learning (ML) is one of the major underpinnings of Microsoft Sentinel, and one of the main attributes that set it apart. Microsoft Sentinel offers ML in several experiences: built-in to the 💡 [Fusion](https://docs.microsoft.com/azure/sentinel/fusion) correlation engine and Jupyter notebooks, and the newly available Build-Your-Own ML (BYOML) platform. ML detection models can adapt to individual environments and to changes in user behavior, to reduce 💡[false positives](https://docs.microsoft.com/azure/sentinel/false-positives) and identify threats that wouldn't be found with a traditional approach. Many security organizations understand the value of ML for security, though not many of them have the luxury of professionals who have expertise in both security and ML. We designed the framework presented here for security organizations and professionals to grow with us in their ML journey. Organizations new to ML, or without the necessary expertise, can get significant protection value out of Microsoft Sentinel's built-in ML capabilities. There are several layers and components of Microsoft's AI/ML offerings for security detections which include, but are not limited to:
\r\n
\r\n1️⃣ KQL Query [Autocluster](https://docs.microsoft.com/azure/data-explorer/kusto/query/autoclusterplugin), [Basket](https://docs.microsoft.com/azure/data-explorer/kusto/query/basketplugin), [DiffPatterns](https://docs.microsoft.com/azure/data-explorer/kusto/query/diffpatternsplugin)
\r\n2️⃣ Built-in Tooling Algorithms [Out-Of-The-Box](https://docs.microsoft.com/azure/sentinel/detect-threats-built-in), [OCR](https://docs.microsoft.com/microsoft-365/compliance/communication-compliance-feature-reference#optical-character-recognition-ocr), [Trainable Classifiers](https://docs.microsoft.com/microsoft-365/compliance/classifier-get-started-with)
\r\n3️⃣ User and Entity Behavior Analytics [Sentinel UEBA](https://docs.microsoft.com/azure/sentinel/identify-threats-with-entity-behavior-analytics), [M365 IRM UEBA](https://docs.microsoft.com/microsoft-365/compliance/insider-risk-management-cases), [MDfCA UEBA](https://docs.microsoft.com/cloud-app-security/tutorial-suspicious-activity)
\r\n5️⃣ Advanced Multistage Attack Detection [Fusion Rules](https://docs.microsoft.com/azure/sentinel/fusion#enable-fusion-rule), [SOC-ML Anomaly Rules](https://docs.microsoft.com/azure/sentinel/soc-ml-anomalies)
\r\n6️⃣ Trainable Algorithms [BYOML](https://docs.microsoft.com/azure/sentinel/bring-your-own-ml), [Notebooks](https://docs.microsoft.com/azure/sentinel/notebooks), [Machine Learning Studio](https://docs.microsoft.com/azure/machine-learning/overview-what-is-machine-learning-studio)\r\n\r\n\r\n\r\n" }, "customWidth": "40", "name": "text - 179" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 18" }, { "type": 1, "content": { "json": "# [Bring Your Own Machine Learning (BYOML)](https://docs.microsoft.com/azure/sentinel/bring-your-own-ml) \r\n---\r\n![Image Name](https://docs.microsoft.com/azure/sentinel/media/bring-your-own-ml/machine-learning-framework.png)
\r\n\r\n" }, "customWidth": "50", "name": "text - 179 - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "60106e49-64fe-43dc-9f83-a20b316e43c2", "linkTarget": "OpenBlade", "linkLabel": "Entity Behavior", "style": "secondary", "bladeOpenContext": { "bladeName": "EntitySearchBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [] } }, { "id": "71ec78f0-af41-4ba5-8945-2cc6d3071c86", "linkTarget": "OpenBlade", "linkLabel": "Notebooks", "style": "secondary", "bladeOpenContext": { "bladeName": "NotebookBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [] } }, { "id": "8b4da7f4-1579-473d-9332-f93ec13189fa", "linkTarget": "OpenBlade", "linkLabel": "Automation", "style": "secondary", "bladeOpenContext": { "bladeName": "AutomationBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [] } } ] }, "name": "EL0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityAlert\r\n| where ProviderName contains \"fusion\" or AlertName contains \"fusion\"\r\n| distinct AlertName, ProviderName, AlertLink, Tactics, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Fusion Alerts", "noDataMessage": "There are no results within the selected thresholds (time, workspace, subscription). See Advanced multistage attack detection in Microsoft Sentinel (https://docs.microsoft.com/azure/sentinel/fusion)", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "3", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ProductName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Alert >" } }, { "columnMatch": "UPN", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "2", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Incident >" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results310", "comparison": "isEqualTo", "value": "Yes" }, "name": "310a" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityAlert\r\n| where ProviderName contains \"fusion\" or AlertName contains \"fusion\"\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by AlertName\r\n| render timechart", "size": 0, "showAnalytics": true, "title": "Fusion Alerts over Time", "noDataMessage": "There are no results within the selected thresholds (time, workspace, subscription). See Advanced multistage attack detection in Microsoft Sentinel (https://docs.microsoft.com/azure/sentinel/fusion)", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "3", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ProductName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Alert >" } }, { "columnMatch": "UPN", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "2", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Incident >" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results310", "comparison": "isEqualTo", "value": "Yes" }, "name": "310b" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityAlert\r\n| where AlertName contains \"anomal\" or ProviderName contains \"anomal\"\r\n| distinct AlertName, ProviderName, AlertLink, Tactics, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Anomaly Alerts", "noDataMessage": "There are no results within the selected thresholds (time, workspace, subscription). See Use SOC-ML anomalies to detect threats in Microsoft Sentinel (https://docs.microsoft.com/azure/sentinel/soc-ml-anomalies)", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "3", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ProductName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Alert >" } }, { "columnMatch": "UPN", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "2", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Incident >" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results316", "comparison": "isEqualTo", "value": "Yes" }, "name": "316a" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityAlert\r\n| where AlertName contains \"anomal\" or ProviderName contains \"anomal\"\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by AlertName\r\n| render timechart", "size": 0, "showAnalytics": true, "title": "Anomaly Alerts", "noDataMessage": "There are no results within the selected thresholds (time, workspace, subscription). See Use SOC-ML anomalies to detect threats in Microsoft Sentinel (https://docs.microsoft.com/azure/sentinel/soc-ml-anomalies)", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "3", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ProductName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Alert >" } }, { "columnMatch": "UPN", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "2", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Incident >" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results316", "comparison": "isEqualTo", "value": "Yes" }, "name": "Results316b" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where OperationName == \"Create or Update Virtual Machine\" or OperationName == \"Create Deployment\"\r\n| where ActivityStatus == \"Succeeded\"\r\n| make-series num = dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(90d), now(), 1d) by Caller\r\n| extend outliers=series_outliers(num, \"ctukey\", 0, 10, 90)\r\n| mvexpand outliers\r\n| where outliers > 0.9\r\n", "size": 0, "showAnalytics": true, "title": "Creation of An Anomalous Number of Resources (Outliers) by UserName", "noDataMessage": "There are no results within the selected thresholds (time, workspace, subscription). See Use SOC-ML anomalies to detect threats in Microsoft Sentinel (https://docs.microsoft.com/azure/sentinel/soc-ml-anomalies)", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "gridSettings": { "formatters": [ { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "3", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ProductName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Alert >" } }, { "columnMatch": "UPN", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "2", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Incident >" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "graphSettings": { "type": 0 }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results311", "comparison": "isEqualTo", "value": "Yes" }, "name": "311" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where OperationName contains \"delet\" or OperationName contains \"remove\"\r\n| where ActivityStatus == \"Succeeded\"\r\n| make-series num = dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(90d), now(), 1d) by Caller\r\n| extend outliers=series_outliers(num, \"ctukey\", 0, 10, 90)\r\n| mvexpand outliers\r\n| where outliers > 0.9\r\n", "size": 0, "showAnalytics": true, "title": "Deletion of An Anomalous Number of Resources (Outliers) by UserName", "noDataMessage": "There are no results within the selected thresholds (time, workspace, subscription). See Use SOC-ML anomalies to detect threats in Microsoft Sentinel (https://docs.microsoft.com/azure/sentinel/soc-ml-anomalies)", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "linechart", "gridSettings": { "formatters": [ { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "3", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ProductName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Alert >" } }, { "columnMatch": "UPN", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "2", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Incident >" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "graphSettings": { "type": 0 }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results312", "comparison": "isEqualTo", "value": "Yes" }, "name": "312" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityAlert\r\n| extend User_Account_ = tostring(parse_json(ExtendedProperties).[\"User Account\"])\r\n| project AlertName, ProviderName, User_Account_\r\n| evaluate basket(0.01)\r\n| project Percent, Count, AlertName, ProviderName, User_Account_\r\n| where ProviderName <> \"\"\r\n| sort by Percent desc\r\n", "size": 0, "showAnalytics": true, "title": "Security Alert Frequency by Basket", "noDataMessage": "There are no results within the selected thresholds (time, workspace, subscription). See Use SOC-ML anomalies to detect threats in Microsoft Sentinel (https://docs.microsoft.com/azure/sentinel/soc-ml-anomalies)", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Percent", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "3", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ProductName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Alert >" } }, { "columnMatch": "UPN", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "2", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Incident >" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "graphSettings": { "type": 0 }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results313", "comparison": "isEqualTo", "value": "Yes" }, "name": "313" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityAlert\r\n| project AlertName, ProviderName\r\n| evaluate autocluster(0.1)\r\n| where ProviderName <> \"\"\r\n| project Percent, Count, ProviderName, AlertName\r\n| sort by Percent desc\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Security Alert Autocluster (Tool Efficiency Tuning)", "noDataMessage": "There are no results within the selected thresholds (time, workspace, subscription). See Use SOC-ML anomalies to detect threats in Microsoft Sentinel (https://docs.microsoft.com/azure/sentinel/soc-ml-anomalies)", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Percent", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "3", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ProductName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Alert >" } }, { "columnMatch": "UPN", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "2", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Incident >" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "graphSettings": { "type": 0 }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results314", "comparison": "isEqualTo", "value": "Yes" }, "name": "314" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SigninLogs\r\n| where RiskState == \"atRisk\"\r\n| project UserPrincipalName, Location, AppDisplayName, RiskState\r\n| evaluate basket(0.01)\r\n| where UserPrincipalName <> \"\"\r\n| where AppDisplayName <> \"\"\r\n| project Percent, UserPrincipalName, Location, AppDisplayName, RiskState\r\n| sort by Percent desc\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Risky Application Access (Basket)", "noDataMessage": "There are no results within the selected thresholds (time, workspace, subscription). See Use SOC-ML anomalies to detect threats in Microsoft Sentinel (https://docs.microsoft.com/azure/sentinel/soc-ml-anomalies)", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Percent", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "Location", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Globe", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "3", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ProductName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Alert >" } }, { "columnMatch": "UPN", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "2", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Incident >" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "graphSettings": { "type": 0 }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Results315", "comparison": "isEqualTo", "value": "Yes" }, "name": "315" } ] }, "conditionalVisibility": { "parameterName": "isAIMLVisible", "comparison": "isEqualTo", "value": "true" }, "name": "AI/ML" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Azure Lighthouse](https://azure.microsoft.com/services/azure-lighthouse/)\r\n---\r\nAzure Lighthouse helps service providers simplify customer engagement and onboarding experiences, while managing delegated resources at scale with agility and precision. Authorized users, groups, and service principals can work directly in the context of a customer subscription without having an account in that customer's Microsoft Entra ID (EntraID) tenant or being a co-owner of the customer's tenant. The mechanism used to support this access is called Azure delegated resource management. " }, "customWidth": "40", "name": "text - 5" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "1cf637a7-121d-4722-b511-b0c460625e31", "linkTarget": "OpenBlade", "linkLabel": "Access Azure Lighthouse", "style": "secondary", "bladeOpenContext": { "bladeName": "LighthouseBlade", "extensionName": "Microsoft_Azure_CustomerHub", "bladeParameters": [] } } ] }, "customWidth": "50", "name": "links - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "managedservicesresources\r\n| where type == \"microsoft.managedservices/registrationassignments\"\r\n| where properties.provisioningState == \"Succeeded\"\r\n| extend ManageeTenantName = properties.registrationDefinition.properties.manageeTenantName\r\n| extend ManagedByTenantName = properties.registrationDefinition.properties.managedByTenantName\r\n| extend ManagedByTenantId = properties.registrationDefinition.properties.managedByTenantId\r\n| extend ManageeTenantId = tostring(properties.registrationDefinition.properties.manageeTenantId)\r\n| extend PermanentAccess = properties.registrationDefinition.properties.authorizations\r\n| extend JITAccess = properties.registrationDefinition.properties.eligibleAuthorizations\r\n| extend AddedDate = properties.registrationDefinition.systemData.createdAt\r\n| extend CreatedBy = systemData.createdBy\r\n| project ManageeTenantName, ManageeTenantId, ManagedByTenantName, ManagedByTenantId, AddedDate, CreatedBy", "size": 1, "showAnalytics": true, "title": "Azure Lighthouse Delegations", "noDataMessage": "No Azure Lighthouse Delegations/Customers Detected", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "gridSettings": { "formatters": [ { "columnMatch": "ManageeTenantName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Download", "text": "{0}{1}" } ] } }, { "columnMatch": "ManageeTenantId", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "ManagedByTenantName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Upload", "text": "{0}{1}" } ] } }, { "columnMatch": "ManagedByTenantId", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "AddedDate", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Clock", "text": "{0}{1}" } ] } }, { "columnMatch": "CreatedBy", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "PermanentAccess", "formatter": 1 }, { "columnMatch": "JITAccess", "formatter": 1 } ], "filter": true } }, "name": "query - 21 - Copy" } ] }, "conditionalVisibility": { "parameterName": "isAzureLighthouseVisible", "comparison": "isEqualTo", "value": "true" }, "name": "group - 21" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Recommended Content](https://docs.microsoft.com/azure/sentinel/sentinel-solutions-catalog)\r\n---\r\n\r\nThe following content packages provide utility for regulated industries use cases." }, "name": "NS Guide" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "b9a6293e-1c7b-4ec2-ad2a-d72b5ee01722", "cellValue": "https://docs.microsoft.com/azure/sentinel/sentinel-solutions", "linkTarget": "Url", "linkLabel": "About Microsoft Sentinel Content & Solutions", "style": "link" }, { "id": "1bad541e-219a-4277-9510-876b0e8cad51", "cellValue": "https://docs.microsoft.com/azure/sentinel/sentinel-solutions-catalog", "linkTarget": "Url", "linkLabel": "Content Hub Catalog", "style": "link" } ] }, "name": "links - 29" } ] }, "customWidth": "40", "name": "group - 4" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "76c7831e-386d-4289-8145-486f52cba8ec", "linkTarget": "OpenBlade", "linkLabel": "Content Hub >>", "style": "secondary", "bladeOpenContext": { "bladeName": "ContentHub.ReactView", "extensionName": "Microsoft_Azure_SentinelUS", "bladeParameters": [] } } ] }, "customWidth": "40", "name": "EL0" } ] }, "name": "group - 7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Zero Trust (TIC 3.0) Solution](https://docs.microsoft.com/security/zero-trust/integrate/sentinel-solution)\r\n\r\n---\r\nThe Microsoft Sentinel Zero Trust (TIC 3.0) Solution provides a mechanism for viewing log queries aligned to Zero Trust and Trusted Internet Connections models across the Microsoft and partner ecosystem. This solution enables governance and compliance teams to design, build, monitor, and respond to Zero Trust (TIC 3.0) requirements across cloud, multi-cloud, 1st/3rd party workloads. The solution includes the new Zero Trust (TIC 3.0) Workbook, (1) Analytics Rule, and (3) Playbooks. While only Microsoft Sentinel and Microsoft Defender for Cloud are required to get started, the solution is enhanced with numerous Microsoft offerings.
\r\n\r\n---\r\n\r\n" }, "name": "text - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "1bad541e-219a-4277-9510-876b0e8cad51", "cellValue": "https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/next-evolution-of-the-microsoft-sentinel-zero-trust-tic-3-0/ba-p/3278097", "linkTarget": "Url", "linkLabel": "Solution Blog", "style": "link" }, { "id": "b9a6293e-1c7b-4ec2-ad2a-d72b5ee01722", "cellValue": "https://youtu.be/CxLzTRPuw-4", "linkTarget": "Url", "linkLabel": "Video Demo", "style": "link" }, { "id": "7e8ff8aa-f632-4a4d-90cf-a71da0dc6b31", "cellValue": "https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/ZeroTrust(TIC3.0)", "linkTarget": "Url", "linkLabel": "GitHub Repo", "style": "link" } ] }, "name": "links - 29" }, { "type": 1, "content": { "json": "![Image Name](https://techcommunity.microsoft.com/t5/image/serverpage/image-id/331934iC71A9ECE39F53E71/image-size/large?v=v2&px=999)\r\n\r\n" }, "customWidth": "80", "name": "text - 2" } ] }, "customWidth": "50", "name": "Zero Trust Solution" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [NIST SP 800-53 Solution](https://docs.microsoft.com/security/zero-trust/integrate/sentinel-solution)\r\n\r\n---\r\nThis solution is designed to augment staffing through automation, machine learning, query/alerting generation, and visualizations. This workbook leverages Azure Policy, Azure Resource Graph, and Azure Log Analytics to align with NIST SP 800-53 control requirements. This offering telemetry from 25+ Microsoft Security products (1P/3P/Multi-Cloud/Hybrid/On-Premises). Each NIST SP 800-53 control includes a Control Card detailing an overview of requirements, primary/secondary controls, deep-links to referenced product pages/portals, recommendations, implementation guides, compliance cross-walks and tooling telemetry for building situational awareness of cloud workloads.
\r\n\r\n---\r\n\r\n" }, "name": "text - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "1bad541e-219a-4277-9510-876b0e8cad51", "cellValue": "https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/announcing-the-microsoft-sentinel-nist-sp-800-53-solution/ba-p/3381485", "linkTarget": "Url", "linkLabel": "Solution Blog", "style": "link" }, { "id": "b9a6293e-1c7b-4ec2-ad2a-d72b5ee01722", "cellValue": "https://youtu.be/ju9hxtYnj7s", "linkTarget": "Url", "linkLabel": "Video Demo", "style": "link" }, { "id": "7e8ff8aa-f632-4a4d-90cf-a71da0dc6b31", "cellValue": "https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/NISTSP80053", "linkTarget": "Url", "linkLabel": "GitHub Repo", "style": "link" } ] }, "name": "links - 29" }, { "type": 1, "content": { "json": "![Image Name](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NISTSP80053/Workbooks/Images/NISTSP80053Black.png?raw=true)" }, "customWidth": "90", "name": "text - 2" } ] }, "customWidth": "50", "name": "group - 10" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Cybersecurity Maturity Model Certification (CMMC) 2.0](https://www.acq.osd.mil/cmmc/index.html)\r\n---\r\n\r\nThis solution enables Compliance Teams, Architects, SecOps Analysts, and Consultants to gain situational awareness for cloud workload security posture. This solution is designed to augment staffing through automation, visibility, assessment, monitoring and remediation. This solution includes (1) Workbook for build/design/assessment/reporting, (2) Analytics rules for monitoring and (3) Playbooks for response/remediation. CMMC 2.0 is the next iteration of the Department’s CMMC cybersecurity model. It streamlines requirements to three levels of cybersecurity – Foundational, Advanced and Expert – and aligns the requirements at each level with well-known and widely accepted NIST cybersecurity standards.
\r\n\r\n---\r\n\r\n" }, "name": "text - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "1bad541e-219a-4277-9510-876b0e8cad51", "cellValue": "https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/announcing-the-microsoft-sentinel-cybersecurity-maturity-model/ba-p/3295095", "linkTarget": "Url", "linkLabel": "Solution Blog", "style": "link" }, { "id": "b9a6293e-1c7b-4ec2-ad2a-d72b5ee01722", "cellValue": "https://youtu.be/-_a5HxJgriE", "linkTarget": "Url", "linkLabel": "Video Demo", "style": "link" }, { "id": "7e8ff8aa-f632-4a4d-90cf-a71da0dc6b31", "cellValue": "https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/CybersecurityMaturityModelCertification(CMMC)2.0", "linkTarget": "Url", "linkLabel": "GitHub Repo", "style": "link" } ] }, "name": "links - 29" }, { "type": 1, "content": { "json": "![Image Name](https://techcommunity.microsoft.com/t5/image/serverpage/image-id/366916iE9E6352466301203/image-size/large?v=v2&px=999)" }, "customWidth": "75", "name": "text - 2" } ] }, "customWidth": "50", "name": "group - 9" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Azure Security Benchmark v3](https://docs.microsoft.com/security/benchmark/azure/)\r\n---\r\n\r\nEnables Cloud Architects, Security Engineers, and Governance Risk Compliance Professionals to gain situational awareness for cloud security posture and hardening. Benchmark recommendations provide a starting point for selecting specific security configuration settings and facilitate risk reduction. The Azure Security Benchmark includes a collection of high-impact security recommendations for improving posture. This workbook provides visibility and situational awareness for security capabilities delivered with Microsoft technologies in predominantly cloud-based environments. Customer experience will vary by user and some panels may require additional configurations for operation.
\r\n\r\n---\r\n\r\n" }, "name": "text - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "1bad541e-219a-4277-9510-876b0e8cad51", "cellValue": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/azure-security-benchmark-v3-workbook/ba-p/3257673", "linkTarget": "Url", "linkLabel": "Announce Blog", "style": "link" }, { "id": "b9a6293e-1c7b-4ec2-ad2a-d72b5ee01722", "cellValue": "https://youtu.be/v57gWjvcY4o", "linkTarget": "Url", "linkLabel": "Video Demo", "style": "link" }, { "id": "cc5f4830-f090-4f5e-afb2-47adba6be532", "cellValue": "https://youtu.be/qVJjwOipHDA", "linkTarget": "Url", "linkLabel": "ASC in the Field", "style": "link" }, { "id": "7e8ff8aa-f632-4a4d-90cf-a71da0dc6b31", "cellValue": "https://github.com/Azure/Microsoft-Defender-for-Cloud/tree/main/Workbooks/Azure%20Security%20Benchmark%20v3", "linkTarget": "Url", "linkLabel": "GitHub Repo", "style": "link" } ] }, "name": "links - 29" }, { "type": 1, "content": { "json": "![Image Name](https://techcommunity.microsoft.com/t5/image/serverpage/image-id/356031i1852A90B40FA85CF/image-size/large?v=v2&px=999)" }, "customWidth": "86", "name": "text - 2" } ] }, "customWidth": "50", "name": "group - 9" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Microsoft Insider Risk Management Solution](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/announcing-the-microsoft-sentinel-microsoft-insider-risk/ba-p/2955786)\r\n---\r\n\r\nInsider risk management helps minimize internal risks by enabling you to detect, investigate, and act on malicious and inadvertent activities in your organization. Insider risk policies allow you to define the types of risks to identify and detect in your organization, including acting on cases and escalating cases to Microsoft Advanced eDiscovery. Risk analysts in your organization can quickly take appropriate actions to make sure users are compliant with your organization's compliance standards. Insider risks come in various forms including both witting (intentional) and unwitting (unintentional). This workbook provides an automated visualization of Insider risk behavior cross walked to Microsoft security offerings.
\r\n\r\n---\r\n\r\n" }, "name": "text - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "1bad541e-219a-4277-9510-876b0e8cad51", "cellValue": "https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/announcing-the-microsoft-sentinel-microsoft-insider-risk/ba-p/2955786", "linkTarget": "Url", "linkLabel": "Solution Blog", "style": "link" }, { "id": "7e8ff8aa-f632-4a4d-90cf-a71da0dc6b31", "cellValue": "https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/MicrosoftPurviewInsiderRiskManagement", "linkTarget": "Url", "linkLabel": "GitHub Repo", "style": "link" } ] }, "name": "links - 29" }, { "type": 1, "content": { "json": "![Image Name](https://techcommunity.microsoft.com/t5/image/serverpage/image-id/326371i9E5EA3A8269A3D54/image-size/large?v=v2&px=999)" }, "customWidth": "75", "name": "text - 2" } ] }, "customWidth": "50", "name": "group - 9" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [IT/OT Threat Monitoring Solution](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/defending-critical-infrastructure-with-the-microsoft-sentinel-it/ba-p/3061184)\r\n---\r\n\r\nThis solution provides the foundation for building a SOC for monitoring IoT/ OT and includes (1) workbook for visibility/reporting, (14) analytics rules for monitoring, and (4) playbooks for response. The workbook leverages Microsoft Sentinel telemetry to create visualization to understand, analyze, and respond to IoT/OT threats. Understanding alerts over time provides unprecedented insights into security posture and where teams need to focus to harden against threats. Deep links directly to Microsoft Defender for IoT alerts empower analysts to focus on remediating threats rather than pivoting between tools.
\r\n\r\n---\r\n\r\n" }, "name": "text - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "1bad541e-219a-4277-9510-876b0e8cad51", "cellValue": "https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/defending-critical-infrastructure-with-the-microsoft-sentinel-it/ba-p/3061184", "linkTarget": "Url", "linkLabel": "Solution Blog", "style": "link" }, { "id": "8f7dce97-a41c-42b3-b62f-a21fbf5a1420", "cellValue": "https://youtu.be/hZS2aplJoy8", "linkTarget": "Url", "linkLabel": "YouTube Demo", "style": "link" }, { "id": "7e8ff8aa-f632-4a4d-90cf-a71da0dc6b31", "cellValue": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IoTOTThreatMonitoringwithDefenderforIoT/readme.md", "linkTarget": "Url", "linkLabel": "GitHub Repo", "style": "link" } ] }, "name": "links - 29" }, { "type": 1, "content": { "json": "![Image Name](https://techcommunity.microsoft.com/t5/image/serverpage/image-id/339516iD1FE1014CDCB1E04/image-size/large?v=v2&px=999)" }, "customWidth": "75", "name": "text - 2" } ] }, "customWidth": "50", "name": "group - 9" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Maturity Model for Event Log Management Solution](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/modernize-log-management-with-the-maturity-model-for-event-log/ba-p/3072842)\r\n---\r\n\r\nThis solution is designed to enable Cloud Architects, Security Engineers, and Governance Risk Compliance Professionals to increase visibility before, during, and after a cybersecurity incident.\"Executive Order 14028, Improving the Nation's Cybersecurity, directs decisive action to improve the Federal Government’s investigative and remediation capabilities. This memorandum was developed in accordance with and addresses the requirements in section 8 of the Executive Order for logging, log retention, and log management, with a focus on ensuring centralized access and visibility for the highest-level enterprise security operations center (SOC) of each agency.\" For more information, see 💡[OMB's M-21-31 Memorandum](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\r\n\r\n---\r\n\r\n" }, "name": "text - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "1bad541e-219a-4277-9510-876b0e8cad51", "cellValue": "https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/modernize-log-management-with-the-maturity-model-for-event-log/ba-p/3072842", "linkTarget": "Url", "linkLabel": "Solution Blog", "style": "link" }, { "id": "b9a6293e-1c7b-4ec2-ad2a-d72b5ee01722", "cellValue": "https://youtu.be/quV_80ts__k", "linkTarget": "Url", "linkLabel": "Video Demo", "style": "link" }, { "id": "7e8ff8aa-f632-4a4d-90cf-a71da0dc6b31", "cellValue": "https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/MaturityModelForEventLogManagementM2131", "linkTarget": "Url", "linkLabel": "GitHub Repo", "style": "link" } ] }, "name": "links - 29" }, { "type": 1, "content": { "json": "![Image Name](https://techcommunity.microsoft.com/t5/image/serverpage/image-id/342601i34E2E96C5959D837/image-dimensions/799x468?v=v2)" }, "customWidth": "75", "name": "text - 2" } ] }, "customWidth": "50", "name": "group - 8" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Threat Analysis & Response Solution](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/ThreatAnalysis%26Response)\r\n---\r\n\r\nThis solution enables SecOps Analysts, Threat Intelligence Professional, and Threat Hunters to gain situational awareness for threats in cloud environment. The Solution includes (2) Workbooks designed to enable threat hunting programs. Threat analysis provides an understanding of where the attacker is in the cycle which often drives both a historic lens of where the threat may have progressed, but also predictive analytics on the threat’s objectives. This approach is adversarial as understanding of the threat’s attack cycle drives defense actions in a red versus blue model. The Threat Analysis & Response Solution augments the customer burden of building threat hunting programs.\r\n\r\n---\r\n\r\n" }, "name": "text - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "7e8ff8aa-f632-4a4d-90cf-a71da0dc6b31", "cellValue": "https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/ThreatAnalysis%26Response", "linkTarget": "Url", "linkLabel": "GitHub Repo", "style": "link" } ] }, "name": "links - 29" }, { "type": 1, "content": { "json": "![Image Name](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ThreatAnalysis%26Response/Workbooks/Images/ThreatAnalysis%26ResponseWhite1.png?raw=true)" }, "customWidth": " 100", "name": "text - 2" } ] }, "customWidth": "50", "name": "group - 9" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Threat Intelligence Workbook](https://docs.microsoft.com/security/benchmark/azure/)\r\n---\r\n\r\nThe most commonly used form of CTI is threat indicators, also known as Indicators of Compromise or IoCs. Threat indicators are data that associate observed artifacts such as URLs, file hashes, or IP addresses with known threat activity such as phishing, botnets, or malware. This form of threat intelligence is often called tactical threat intelligence because it can be applied to security products and automation in large scale to detect potential threats to an organization and protect against them. In Microsoft Sentinel, you can use threat indicators to help detect malicious activity observed in your environment and provide context to security investigators to help inform response decisions.
\r\n\r\n---" }, "name": "text - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "1bad541e-219a-4277-9510-876b0e8cad51", "cellValue": "https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-azure-sentinel-threat-intelligence-workbook/ba-p/2858265", "linkTarget": "Url", "linkLabel": "Workbook Blog", "style": "link" }, { "id": "b9a6293e-1c7b-4ec2-ad2a-d72b5ee01722", "cellValue": "https://youtu.be/SjEG7iVVBbI", "linkTarget": "Url", "linkLabel": "Video Demo", "style": "link" }, { "id": "7e8ff8aa-f632-4a4d-90cf-a71da0dc6b31", "cellValue": "https://github.com/Azure/Azure-Sentinel/blob/master/Workbooks/ThreatIntelligence.json", "linkTarget": "Url", "linkLabel": "GitHub Repo", "style": "link" } ] }, "name": "links - 29" }, { "type": 1, "content": { "json": "![Image Name](https://techcommunity.microsoft.com/t5/image/serverpage/image-id/318165iE3D0AFA0BD5DF73C/image-size/large?v=v2&px=999)" }, "name": "text - 2" } ] }, "customWidth": "50", "name": "Zero Trust Solution - Copy - Copy - Copy" } ] }, "conditionalVisibility": { "parameterName": "isGCVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Recommended Content" } ], "fromTemplateId": "sentinel-InsiderRiskManagement", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }