{ "version": "Notebook/1.0", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "IronDefense", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "a9f97bc9-5ee0-412a-ab04-d6f170a8aa7d", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Filter by Time", "type": 4, "isRequired": true, "value": { "durationMs": 7776000000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 } }, { "id": "b9ef6a57-cc0b-4b6c-8ec0-d606b3939009", "version": "KqlParameterItem/1.0", "name": "filter", "label": "Filter Alerts", "type": 2, "multiSelect": true, "quote": "'", "delimiter": ",", "value": [ "THREAT_INTELLIGENCE_RULE_MATCH" ], "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[{\"value\":\"SEVERITY_WHITELISTED\",\"text\":\"Exclude Safelist Alerts\",\"selected\":true},\r\n{\"value\":\"THREAT_INTELLIGENCE_RULE_MATCH\",\"text\":\"Exclude Blocklist Alerts\",\"selected\":true},\r\n{\"value\":\"STATUS_CLOSED\",\"text\":\"Exclude Closed Alerts\",\"selected\":true}]", "timeContext": { "durationMs": 86400000 } } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "58b0a390-3085-498a-8368-3279e3195a4d", "version": "KqlParameterItem/1.0", "name": "AlertRecords", "type": 1, "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 } }, { "id": "6a794c03-2319-46b3-94ab-52c47f8c8b94", "version": "KqlParameterItem/1.0", "name": "condition", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "filter", "operator": "is Empty", "rightValType": "param", "resultValType": "static", "resultVal": "DeviceCustomString4 != \"\" " } }, { "criteriaContext": { "leftOperand": "filter", "operator": "isNotNull", "rightValType": "param", "resultValType": "static", "resultVal": "DeviceCustomString4 != \"\" and (DeviceCustomString1 !in ({filter:value}) and DeviceCustomString2 !in ({filter:value}) and Subcategory !in ({filter:value}))" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "null" } } ], "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 14" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceProduct == \"IronDefense\" and isnotempty(DeviceCustomString2) and Activity != \"\"\r\n| summarize arg_max(TimeGenerated,*) by DeviceCustomString4\r\n| project AdditionalExtensions, TimeGenerated,DeviceCustomString4,DeviceCustomString2,DeviceCustomString1\r\n| extend Subcategory = extract(@'subcat=([^;]+)(\\;|$)',1, AdditionalExtensions)\r\n| where {condition}\r\n| summarize alerts = count() by DeviceCustomString4, TimeGenerated\r\n", "size": 4, "aggregation": 4, "showAnalytics": true, "title": "Alert Count over time", "noDataMessage": "No Data found", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "timeBrushParameterName": "timebrush", "timeBrushExportOnlyWhenBrushed": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "scatterchart", "chartSettings": { "xAxis": "TimeGenerated", "yAxis": [ "alerts" ], "group": "DeviceCustomString4", "createOtherGroup": null, "showMetrics": false, "seriesLabelSettings": [ { "seriesName": "EventCount", "label": "Events going to occur", "comment": "" } ], "xSettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } }, "ySettings": { "numberFormatSettings": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } }, "min": 0, "max": 15 } } }, "showPin": false, "name": "Timeline" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceProduct == \"IronDefense\" and isnotempty(DeviceCustomString2) and Activity != \"\"\r\n| summarize arg_max(TimeGenerated,*) by DeviceCustomString4\r\n| project AdditionalExtensions, TimeGenerated,DeviceCustomString4,DeviceCustomString2,DeviceCustomString1\r\n| extend Subcategory = extract(@'subcat=([^;]+)(\\;|$)',1, AdditionalExtensions)\r\n| where {condition}\r\n| summarize alerts = count() by DeviceCustomString4, TimeGenerated", "size": 4, "showAnalytics": true, "noDataMessage": "No Data found", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "timebrush", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "unstackedbar", "chartSettings": { "xAxis": "TimeGenerated", "yAxis": [ "alerts" ], "group": "DeviceCustomString4", "createOtherGroup": null, "showMetrics": false, "showLegend": true, "xSettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } }, "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } } } }, "conditionalVisibility": { "parameterName": "timebrush", "comparison": "isNotEqualTo" }, "name": "zoom Alert time chart" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "f9df59b5-60d7-453b-a190-454a9d5af3ae", "version": "KqlParameterItem/1.0", "name": "LowSeverityCount", "type": 1, "query": "CommonSecurityLog\r\n| where DeviceProduct == \"IronDefense\" and isnotempty(DeviceCustomString2)\r\n| summarize arg_max(TimeGenerated,*) by DeviceCustomString4\r\n| extend Subcategory = extract(@'subcat=([^;]+)(\\;|$)',1, AdditionalExtensions)\r\n| where {condition} and LogSeverity == \"Low\"\r\n| summarize lowseverity = count() by LogSeverity\r\n| project lowseverity\r\n", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "d2139c75-e718-4a86-a900-4a6ad9642afc", "version": "KqlParameterItem/1.0", "name": "HighSeverityCount", "type": 1, "query": "CommonSecurityLog\r\n| where DeviceProduct == \"IronDefense\" and isnotempty(DeviceCustomString2)\r\n| summarize arg_max(TimeGenerated,*) by DeviceCustomString4\r\n| extend Subcategory = extract(@'subcat=([^;]+)(\\;|$)',1, AdditionalExtensions)\r\n| where {condition} and LogSeverity == \"High\"\r\n| summarize highseverity = count() by LogSeverity\r\n| project highseverity", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "1bfbb7b7-2397-4c10-9bd1-0a570ee21449", "version": "KqlParameterItem/1.0", "name": "MediumSeverityCount", "type": 1, "query": "CommonSecurityLog\r\n| where DeviceProduct == \"IronDefense\" and isnotempty(DeviceCustomString2)\r\n| summarize arg_max(TimeGenerated,*) by DeviceCustomString4\r\n| extend Subcategory = extract(@'subcat=([^;]+)(\\;|$)',1, AdditionalExtensions)\r\n| where {condition} and LogSeverity == \"Medium\"\r\n| summarize mediumseverity = count() by LogSeverity\r\n| project mediumseverity", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "5af782e4-3662-45a7-91f2-92f40dc7a620", "version": "KqlParameterItem/1.0", "name": "CriticalSeverityCount", "type": 1, "query": "CommonSecurityLog\r\n| where DeviceProduct == \"IronDefense\" and isnotempty(DeviceCustomString2)\r\n| summarize arg_max(TimeGenerated,*) by DeviceCustomString4\r\n| extend Subcategory = extract(@'subcat=([^;]+)(\\;|$)',1, AdditionalExtensions)\r\n| where {condition} and LogSeverity == \"Very-High\"\r\n| summarize criticalseverity = count() by LogSeverity\r\n| project criticalseverity", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "1bee5c74-b3fa-49bb-bf75-0f802815ad8e", "version": "KqlParameterItem/1.0", "name": "TotalSeverityCount", "type": 1, "query": "CommonSecurityLog\r\n| where DeviceProduct == \"IronDefense\" and isnotempty(DeviceCustomString2)\r\n| summarize arg_max(TimeGenerated,*) by DeviceCustomString4\r\n| extend Subcategory = extract(@'subcat=([^;]+)(\\;|$)',1, AdditionalExtensions)\r\n| where {condition} and LogSeverity in (\"Low\",\"Medium\",\"High\",\"Very-High\")\r\n| summarize total = count() by LogSeverity\r\n| summarize totalseverity = sum(total)", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "13b81a24-6eec-4453-b30f-ec7e6c8a6ed8", "version": "KqlParameterItem/1.0", "name": "ConditionalLowSeverityCount", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "LowSeverityCount", "operator": "is Empty", "rightValType": "param", "resultValType": "static", "resultVal": "0" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "param", "resultVal": "LowSeverityCount" } } ], "timeContext": { "durationMs": 1209600000 }, "timeContextFromParameter": "TimeRange" }, { "version": "KqlParameterItem/1.0", "name": "ConditionalMediumSeverityCount", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "MediumSeverityCount", "operator": "is Empty", "rightValType": "param", "resultValType": "static", "resultVal": "0" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "param", "resultVal": "MediumSeverityCount" } } ], "timeContext": { "durationMs": 1209600000 }, "timeContextFromParameter": "TimeRange", "id": "9d2b0fc4-5828-4e38-aa32-3d86927d4f25" }, { "version": "KqlParameterItem/1.0", "name": "ConditionalHighSeverityCount", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "HighSeverityCount", "operator": "is Empty", "rightValType": "param", "resultValType": "static", "resultVal": "0" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "param", "resultVal": "HighSeverityCount" } } ], "timeContext": { "durationMs": 1209600000 }, "timeContextFromParameter": "TimeRange", "id": "064172c9-10aa-4220-bda3-f44306cb6f71" }, { "version": "KqlParameterItem/1.0", "name": "ConditionalCriticalSeverityCount", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "CriticalSeverityCount", "operator": "is Empty", "rightValType": "param", "resultValType": "static", "resultVal": "0" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "param", "resultVal": "CriticalSeverityCount" } } ], "timeContext": { "durationMs": 1209600000 }, "timeContextFromParameter": "TimeRange", "id": "b31435bc-76d4-453a-82a8-492e2b75dc2f" }, { "id": "4346548d-37fa-48cf-9489-c91d323d4db8", "version": "KqlParameterItem/1.0", "name": "ConditionalTotalSeverityCount", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "TotalSeverityCount", "operator": "is Empty", "rightValType": "param", "resultValType": "static", "resultVal": "0" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "param", "resultVal": "TotalSeverityCount" } } ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 13" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "188c7c67-865a-43e2-945f-c987a21d3204", "version": "KqlParameterItem/1.0", "name": "IronNetAlert", "type": 1, "query": " Resources\r\n | where type == \"microsoft.insights/workbooks\" and properties.displayName==\"IronDefenseAlertDetails\"\r\n | project name", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parameters - 18" }, { "type": 1, "content": { "json": "

Alerts

" }, "name": "text - 12" }, { "type": 1, "content": { "json": "\r\n\r\n
\r\n

{ConditionalLowSeverityCount}

\r\n

Low Severity

\r\n
\r\n\r\n" }, "customWidth": "20", "name": "text - 7", "styleSettings": { "padding": "2px" } }, { "type": 1, "content": { "json": "\r\n\r\n
\r\n

{ConditionalMediumSeverityCount}

\r\n

Medium Severity

\r\n
\r\n\r\n" }, "customWidth": "20", "name": "text - 7 - Copy", "styleSettings": { "padding": "3px" } }, { "type": 1, "content": { "json": "\r\n\r\n
\r\n

{ConditionalHighSeverityCount}

\r\n

High Severity

\r\n
\r\n\r\n" }, "customWidth": "20", "name": "text - 7 - Copy - Copy", "styleSettings": { "padding": "3px" } }, { "type": 1, "content": { "json": "\r\n\r\n
\r\n

{ConditionalCriticalSeverityCount}

\r\n

Critical Severity

\r\n
\r\n\r\n" }, "customWidth": "20", "name": "text - 7 - Copy - Copy - Copy", "styleSettings": { "padding": "3px" } }, { "type": 1, "content": { "json": "\r\n\r\n
\r\n

{ConditionalTotalSeverityCount}

\r\n

Total

\r\n
\r\n\r\n" }, "customWidth": "20", "name": "text - 7 - Copy - Copy - Copy - Copy", "styleSettings": { "padding": "3px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceProduct == \"IronDefense\" and isnotempty(DeviceCustomString2)\r\n| summarize arg_max(TimeGenerated,*) by DeviceCustomString4\r\n| project AdditionalExtensions, TimeGenerated,DeviceCustomString4,DeviceCustomString2,DeviceCustomString1\r\n| extend Subcategory = extract(@'subcat=([^;]+)(\\;|$)',1, AdditionalExtensions)\r\n| where {condition}\r\n| extend Category = extract(@'cat=([^;]+)(\\;|$)',1, AdditionalExtensions)\r\n| summarize CategoryCount = count() by Category, TimeGenerated \r\n| render piechart ", "size": 3, "showAnalytics": true, "title": "Top Analytic Models", "noDataMessage": "No Data found", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "gridSettings": { "formatters": [ { "columnMatch": "status", "formatter": 11 } ] }, "chartSettings": { "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "analytic model", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceProduct == \"IronDefense\" and isnotempty(DeviceCustomString2) and Activity != \"\"\r\n| summarize arg_max(TimeGenerated,*) by DeviceCustomString4\r\n| project AdditionalExtensions, TimeGenerated,DeviceCustomString4,DeviceCustomString2,DeviceCustomString1\r\n| extend Subcategory = extract(@'subcat=([^;]+)(\\;|$)',1, AdditionalExtensions)\r\n| where {condition} and Subcategory != \"\"\r\n| summarize subcategoryCount = count() by Subcategory, TimeGenerated \r\n| render piechart ", "size": 3, "showAnalytics": true, "title": "Top Anomalous Alerts", "noDataMessage": "No Data found", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "Anomalous Events", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where isnotempty(Activity) and isnotempty(DeviceCustomString1) and isnotempty(DeviceCustomString2)\r\n| summarize arg_max(TimeGenerated,*) by DeviceCustomString4\r\n| project AdditionalExtensions, TimeGenerated,DeviceCustomString2,DeviceCustomString1,DeviceCustomString4\r\n| extend Subcategory = extract(@'subcat=([^;]+)(\\;|$)',1, AdditionalExtensions)\r\n| where {condition}\r\n| summarize subcategoryCount = count() by Subcategory, TimeGenerated \r\n| render timechart", "size": 1, "showAnnotations": true, "showAnalytics": true, "title": "Alert Count Over Time", "noDataMessage": "No Data found", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "linechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Activity", "formatter": 1 }, "leftContent": { "columnMatch": "countRecord", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 2, "topContent": { "columnMatch": "Activity", "formatter": 1 }, "centerContent": { "columnMatch": "countRecord", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "nodeIdField": "Activity", "sourceIdField": "TimeGenerated", "targetIdField": "countRecord", "graphOrientation": 3, "showOrientationToggles": false, "nodeSize": null, "staticNodeSize": 100, "colorSettings": null, "hivesMargin": 5 }, "chartSettings": { "group": "Subcategory", "createOtherGroup": 10, "showMetrics": false, "showLegend": true, "xSettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } }, "ySettings": { "min": 0, "max": 15 } }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "Event_Count", "sizeAggregation": "Sum", "legendMetric": "Event_Count", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "Event_Count", "heatmapPalette": "greenRed" } } }, "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| whereDeviceProduct==\"IronDefense\" and isnotempty(DeviceCustomString2)\r\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1)\r\n| summarize arg_max(TimeGenerated,*) by DeviceCustomString4\r\n| project AdditionalExtensions, TimeGenerated,DeviceCustomString4,DeviceCustomString3,DeviceCustomString2,Activity,LogSeverity,DeviceCustomNumber1,DestinationHostName,EventCount,DeviceCustomString5,DeviceExternalID,SourceIP,DeviceCustomString1\r\n| extend Category = extract(@'cat=([^;]+)(\\;|$)',1, AdditionalExtensions)\r\n| extend Category = coalesce(column_ifexists(\"DeviceEventCategory\",\"\"),Category)\r\n| extend Subcategory = extract(@'subcat=([^;]+)(\\;|$)',1, AdditionalExtensions)\r\n| where {condition}\r\n| extend IronVueUrl = replace(@'\\\\',@'',DeviceCustomString3)\r\n| extend Status = case(DeviceCustomString2 == \"STATUS_AWAITING_REVIEW\",\"Awaiting Review\",DeviceCustomString2 == \"STATUS_NONE\",\"None\",DeviceCustomString2 == \"STATUS_UNDER_REVIEW\",\"Under Review\",DeviceCustomString2 == \"STATUS_CLOSED\",\"Closed\",DeviceCustomString2)\r\n| extend Behaviour = Subcategory\r\n|projectDeviceCustomString4,IronVueUrl,Subcategory,Status,Category,Behaviour,LogSeverity,DeviceCustomNumber1,DestinationHostName,TimeGenerated,Last_Detection=TimeGenerated,EventCount,DeviceCustomString5,DeviceExternalID,SourceIP\r\n", "size": 1, "showAnalytics": true, "title": "Alert Summary", "noDataMessage": "No Data found", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", "exportFieldName": "DeviceEventClassID", "exportParameterName": "AlertRecords", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "DeviceCustomString4", "formatter": 7, "formatOptions": { "linkTarget": "WorkbookTemplate", "workbookContext": { "componentIdSource": "workbook", "resourceIdsSource": "workbook", "templateIdSource": "parameter", "templateId": "IronNetAlert", "typeSource": "workbook", "gallerySource": "workbook", "locationSource": "default", "passSpecificParams": true, "templateParameters": [ { "name": "AlertId", "source": "column", "value": "DeviceCustomString4" }, { "name": "RiskScore", "source": "column", "value": "DeviceCustomNumber1" }, { "name": "Domain", "source": "column", "value": "DestinationHostName" }, { "name": "TimeRange", "source": "parameter", "value": "TimeRange" }, { "name": "Category", "source": "column", "value": "Category" }, { "name": "Environment", "source": "column", "value": "DeviceExternalID" }, { "name": "Time", "source": "column", "value": "TimeGenerated" }, { "name": "SourceIP", "source": "column", "value": "SourceIP" }, { "name": "Subcategory", "source": "column", "value": "Subcategory" }, { "name": "IronVueUrl", "source": "column", "value": "IronVueUrl" } ] } } }, { "columnMatch": "IronVueUrl", "formatter": 5 }, { "columnMatch": "Subcategory", "formatter": 5 }, { "columnMatch": "Status", "formatter": 1, "formatOptions": { "workbookContext": { "componentIdSource": "workbook", "resourceIdsSource": "workbook", "templateIdSource": "parameter", "templateId": "IronNetAlert", "typeSource": "workbook", "gallerySource": "workbook", "locationSource": "default", "passSpecificParams": true, "templateParameters": [ { "name": "AlertId", "source": "column", "value": "DeviceCustomString4" }, { "name": "RiskScore", "source": "column", "value": "DeviceCustomNumber1" }, { "name": "Domain", "source": "column", "value": "DestinationHostName" }, { "name": "TimeRange", "source": "parameter", "value": "TimeRange" }, { "name": "Category", "source": "column", "value": "Category" }, { "name": "Subcategory", "source": "column", "value": "Subcategory" }, { "name": "Environment", "source": "column", "value": "DeviceExternalID" }, { "name": "Time", "source": "column", "value": "TimeGenerated" }, { "name": "SourceIP", "source": "column", "value": "SourceIP" } ] } } }, { "columnMatch": "DeviceCustomString5", "formatter": 5 }, { "columnMatch": "DeviceExternalID", "formatter": 5 }, { "columnMatch": "SourceIP", "formatter": 5 }, { "columnMatch": "DeviceCustomString3", "formatter": 5 }, { "columnMatch": "DeviceCustomString2", "formatter": 7, "formatOptions": { "linkTarget": "WorkbookTemplate", "linkLabel": "", "linkIsContextBlade": false, "workbookContext": { "componentIdSource": "workbook", "resourceIdsSource": "workbook", "templateIdSource": "parameter", "templateId": "IronNetAlert", "typeSource": "workbook", "gallerySource": "workbook", "locationSource": "default", "passSpecificParams": true, "templateParameters": [ { "name": "AlertId", "source": "column", "value": "DeviceCustomString4" }, { "name": "RiskScore", "source": "column", "value": "DeviceCustomNumber1" }, { "name": "Domain", "source": "column", "value": "DeviceCustomString2" }, { "name": "TimeRange", "source": "parameter", "value": "TimeRange" }, { "name": "Category", "source": "column", "value": "Category" }, { "name": "Subcategory", "source": "column", "value": "Subcategory" }, { "name": "Environment", "source": "column", "value": "DeviceExternalID" }, { "name": "Time", "source": "column", "value": "TimeGenerated" }, { "name": "SourceIP", "source": "column", "value": "SourceIP" } ] }, "bladeOpenContext": { "bladeName": "simple", "extensionName": "PopUpview", "bladeParameters": [ { "name": "alertid", "source": "column", "value": "DeviceEventClassID" }, { "name": "cscd", "source": "column", "value": "Activity" } ] } } }, { "columnMatch": "DeviceEventClassID", "formatter": 5 } ], "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 2 } ], "labelSettings": [ { "columnId": "DeviceCustomString4", "label": "AlertID" }, { "columnId": "Subcategory" }, { "columnId": "Status" }, { "columnId": "Category" }, { "columnId": "Behaviour" }, { "columnId": "LogSeverity", "label": "Severity" }, { "columnId": "DeviceCustomNumber1", "label": "Risk Score" }, { "columnId": "DestinationHostName", "label": "Domains" }, { "columnId": "TimeGenerated", "label": "First Detection" }, { "columnId": "Last_Detection", "label": "Last Detection" }, { "columnId": "EventCount", "label": "Events" }, { "columnId": "DeviceCustomString5", "label": "EventID" }, { "columnId": "DeviceExternalID", "label": "Environment" }, { "columnId": "SourceIP" } ] }, "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 2 } ] }, "name": "query - 13" } ] }, "name": "IronDefenseGroup" } ], "styleSettings": { "paddingStyle": "wide", "spacingStyle": "wide" }, "fromTemplateId": "sentinel-IronDefenseAlertDetails", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }