\r\n💡 [Microsoft 365 Defender integration with Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/microsoft-365-defender-sentinel-integration)
\r\n💡 [Connect Microsoft Entra ID data to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-azure-active-directory)
\r\n\t\r\n### Control Assessment" }, "name": "text - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatus", "label": "Status", "type": 2, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDate", "label": "Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "Notes", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{Notes}" }, "name": "text - 1" }, { "type": 1, "content": { "json": "### Recommended Microsoft Products" }, "name": "text - 2" } ] }, "name": "group - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "94af2358-8b87-44b2-ad87-c84568ab2efd", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Defender for Cloud", "style": "secondary", "bladeOpenContext": { "bladeName": "SecurityMenuBlade", "extensionName": "Microsoft_Azure_Security", "bladeParameters": [] } }, { "id": "19aa07ff-e996-47a7-99f1-b4a6e6ebe5ee", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Entra ID", "style": "secondary", "bladeOpenContext": { "bladeName": "ActiveDirectoryMenuBlade", "extensionName": "Microsoft_AAD_IAM", "bladeParameters": [] } }, { "id": "974e5615-0367-4fca-bdb8-dc2b1b3d38c8", "linkTarget": "OpenBlade", "linkLabel": "Azure Monitor", "style": "secondary", "bladeOpenContext": { "bladeName": "AzureMonitoringBrowseBlade", "extensionName": "Microsoft_Azure_Monitoring", "bladeParameters": [] } } ] }, "name": "links - 2" } ] }, "customWidth": "50", "name": "Control Smartcard" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), NotApplicable = countif(state == \"NotApplicable\"), Applicable = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\"),Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\" or state == \"NotApplicable\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Applicable))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where RecommendationName contains \"allowlist\" or RecommendationName contains \"application control\" or RecommendationName contains \"software\"\r\n| parse Remediate with * '#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, NotApplicable, Applicable, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Recommendations (SWAM-1) ", "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Gear", "text": "{0}{1}" } ] } }, { "columnMatch": "Total", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "[\"Passed\"]/[\"Applicable\"]", "columnSettings": [ { "columnName": "Passed", "color": "green" }, { "columnName": "Failed", "color": "redBright" }, { "columnName": "NotApplicable", "color": "gray" } ] } } }, { "columnMatch": "Remediate", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "Remediate >>", "bladeOpenContext": { "bladeName": "RecommendationsBlade", "extensionName": "Microsoft_Azure_Security", "bladeParameters": [ { "name": "assessmentKey", "source": "column", "value": "assessmentKey" } ] } } }, { "columnMatch": "PassedControls", "formatter": 0, "numberFormat": { "unit": 1, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } } }, { "columnMatch": "Passed", "formatter": 5 }, { "columnMatch": "Failed", "formatter": 5 }, { "columnMatch": "NotApplicable", "formatter": 5 }, { "columnMatch": "Applicable", "formatter": 5 }, { "columnMatch": "assessmentKey", "formatter": 5 } ], "filter": true }, "sortBy": [], "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Failed", "color": "redBright" }, { "seriesName": "Passed", "color": "green" } ] } }, "customWidth": "50", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Trend = SigninLogs\r\n| make-series Trend = dcount(UserPrincipalName) default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by ResourceDisplayName;\r\nSigninLogs\r\n| summarize arg_max(TimeGenerated, *) by ResourceDisplayName, UserPrincipalName\r\n| summarize count() by ResourceDisplayName\r\n| where ResourceDisplayName <> \"\"\r\n| join (Trend) on ResourceDisplayName\r\n| project Application=ResourceDisplayName, UsersAccessing=count_, AccessTrending=Trend\r\n| sort by UsersAccessing desc\r\n| limit 2500", "size": 0, "showAnalytics": true, "title": "Application Inventory (SWAM-1)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Application", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Capture", "text": "{0}{1}" } ] } }, { "columnMatch": "UsersAccessing", "formatter": 4, "formatOptions": { "palette": "green" } }, { "columnMatch": "AccessTrending", "formatter": 9, "formatOptions": { "palette": "green" } } ], "rowLimit": 2500, "filter": true } }, "customWidth": "50", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Trend = SecurityEvent\r\n| make-series Trend = dcount(Computer) default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by Process;\r\nSecurityEvent\r\n| where Process <> \"\"\r\n| where Process <> \"-\"\r\n| summarize arg_max(TimeGenerated, EventID) by Process, Computer\r\n| summarize count() by Process\r\n| join (Trend) on Process\r\n| sort by count_ desc\r\n| project Process, SoftwareInstances=count_, ObservedTrending=Trend\r\n| limit 2500\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Software Inventory (SWAM-1)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Process", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "CloudUpload", "text": "{0}{1}" } ] } }, { "columnMatch": "SoftwareInstances", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "ObservedTrending", "formatter": 9, "formatOptions": { "palette": "blue" } } ], "rowLimit": 2500, "filter": true } }, "customWidth": "50", "name": "query - 3 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let AccessCount = SigninLogs\r\n| summarize count() by UserPrincipalName\r\n| project AccessCount=count_, UserPrincipalName;\r\nlet Profile = SigninLogs\r\n| project AADProfile=UserId, UserPrincipalName;\r\nIdentityInfo\r\n| summarize arg_max(TimeGenerated, GroupMembership, AssignedRoles) by AccountUPN\r\n| extend GroupMemberships = strcat(GroupMembership)\r\n| extend AssignedRoles = strcat(AssignedRoles)\r\n| extend UserPrincipalName = AccountUPN\r\n| where AccountUPN <> \"\"\r\n| where GroupMemberships contains \"admin\" or GroupMemberships contains \"security\" or GroupMemberships contains \"contrib\" or AssignedRoles contains \"admin\" or AssignedRoles contains \"security\" or AssignedRoles contains \"contrib\"\r\n| join (Profile) on UserPrincipalName\r\n| join (AccessCount) on UserPrincipalName\r\n| project UserPrincipalName, AccessCount, AADProfile, GroupMemberships, AssignedRoles\r\n| sort by AccessCount desc\r\n| limit 2500", "size": 0, "showAnalytics": true, "title": "Review Assigned Roles & Group Memberships (SWAM-3)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "User", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "AccessCount", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "AADProfile", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "AAD User Profile >>", "linkIsContextBlade": false, "bladeOpenContext": { "bladeName": "UserDetailsMenuBlade", "extensionName": "Microsoft_AAD_IAM", "bladeParameters": [ { "name": "userId", "source": "column", "value": "AADProfile" } ] } } } ], "rowLimit": 2500, "filter": true } }, "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityNestedRecommendation\r\n| extend SoftwareName = tostring(AdditionalData.SoftwareName)\r\n| extend SoftwareVendor = tostring(AdditionalData.SoftwareVendor)\r\n| extend SoftwareVersion = tostring(AdditionalData.SoftwareVersion)\r\n| where SoftwareName <> \"\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, SoftwareName, SoftwareVendor, SoftwareVersion\r\n| limit 2500\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Software Components (SWAM-5)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Process", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "CloudUpload", "text": "{0}{1}" } ] } }, { "columnMatch": "SoftwareInstances", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "ObservedTrending", "formatter": 9, "formatOptions": { "palette": "blue" } } ], "rowLimit": 2500, "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "AssessedResourceId" ] } } }, "customWidth": "50", "name": "query - 6" } ] }, "conditionalVisibility": { "parameterName": "isSWAMVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Software Asset Management (SWAM) Capability", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "isAssetVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Asset Management Group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Identity & Access Management](https://www.cisa.gov/sites/default/files/2023-08/CDM_Tech%20Volume2_v2.5.pdf)\r\n---\r\nCapability Area that addresses “Who is on the network” and consists of related capabilities that support the IdAM security discipline (i.e., TRUST, BEHAVE, CRED, PRIV). IdAM provides identity proofing and authentication aspects under identity management. It also supports the use, maintenance, and protection of sensitive resources (e.g., data, systems)." }, "customWidth": "40", "name": "Common Requirements Overview" }, { "type": 1, "content": { "json": "" }, "customWidth": "60", "name": "text - 106" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t{ \\\"Control\\\": \\\"User Trust (TRUST)\\\", \\\"tab\\\": \\\"Trust\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Credentials & Authenticators (CRED)\\\", \\\"tab\\\": \\\"Cred\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Privileges (PRIV)\\\", \\\"tab\\\": \\\"Priv\\\" }\\r\\n]\",\"transformers\":null}", "size": 3, "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "tab", "parameterName": "Tab", "parameterType": 1 } ], "queryType": 8, "gridSettings": { "formatters": [ { "columnMatch": "tab", "formatter": 5 } ] } }, "customWidth": "40", "name": "query - 8", "styleSettings": { "showBorder": true } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "a206a547-329b-4003-8832-c16daacca6c6", "version": "KqlParameterItem/1.0", "name": "isTrustVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "Trust", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "id": "b17f2902-5d29-45b2-8712-bff5b7dd1487", "version": "KqlParameterItem/1.0", "name": "isCredVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "Cred", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "id": "793ffbca-13bc-4fac-9535-048cbd9efc54", "version": "KqlParameterItem/1.0", "name": "isPrivVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "Priv", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "10", "name": "Hidden Parameters Selectors" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [User Trust (TRUST)](https://www.cisa.gov/sites/default/files/2023-08/CDM_Tech%20Volume2_v2.5.pdf)\r\nThe CDM TRUST capability reduces the probability of loss in \r\navailability, integrity, and confidentiality of data by ensuring that only properly vetted \r\nusers are given access to credentials and systems commensurate with their role. This \r\nincludes elevated privileges and special security roles. The vetted trust level is \r\nproperly monitored and renewed, per agency policies and applicable statutes.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) 🔷 [SecurityBaseline](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securitybaseline) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) 🔷 [IdentityInfo](https://docs.microsoft.com/azure/azure-monitor/reference/tables/identityinfo) ✳️ [Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n\r\n### Implementation\r\n💡 [Review your security recommendations](https://docs.microsoft.com/azure/defender-for-cloud/review-security-recommendations)
\r\n💡 [Continuously export Microsoft Defender for Cloud data](https://docs.microsoft.com/azure/defender-for-cloud/continuous-export)
\r\n💡 [Apply Azure security baselines to machines](https://docs.microsoft.com/azure/defender-for-cloud/apply-security-baseline)
\r\n💡 [Investigate incidents with Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/investigate-cases)
\r\n💡 [Connect Microsoft Entra ID data to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-azure-active-directory)
\r\n💡 [What are custom security attributes in Microsoft Entra ID?](https://docs.microsoft.com/azure/active-directory/fundamentals/custom-security-attributes-overview)
\r\n\r\n### Control Assessment" }, "name": "text - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatus", "label": "Status", "type": 2, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDate", "label": "Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "Notes", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{Notes}" }, "name": "text - 1" }, { "type": 1, "content": { "json": "### Recommended Microsoft Products
\r\n" }, "name": "text - 1 - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "3c316419-bc18-41ba-a503-8e45e8f6b8f7", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Sentinel", "style": "secondary", "bladeOpenContext": { "bladeName": "BrowseResource", "extensionName": "HubsExtension", "bladeParameters": [ { "name": "resourceType", "source": "static", "value": "microsoft.securityinsightsarg/sentinel" } ] } }, { "id": "eab3f582-841d-45fb-9c29-b0cfaef3aae6", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Defender for Cloud", "style": "secondary", "bladeOpenContext": { "bladeName": "SecurityMenuBlade", "extensionName": "Microsoft_Azure_Security", "bladeParameters": [] } }, { "id": "2be002d0-10f1-4369-8dcc-386c6431e721", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Entra ID", "style": "secondary", "bladeOpenContext": { "bladeName": "ActiveDirectoryMenuBlade", "extensionName": "Microsoft_AAD_IAM", "bladeParameters": [] } } ] }, "name": "links - 2" } ] }, "name": "group - 2" } ] }, "customWidth": "50", "name": "Control Smartcard" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationDisplayName, RecommendationLink | parse RecommendationLink with * '/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName <> \"\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), NotApplicable = countif(RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\"), Applicable = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\"),Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\" or RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\") by RecommendationDisplayName\r\n| extend PassedControls = (Passed/todouble(Applicable))*100\r\n| join (CustomView) on RecommendationDisplayName\r\n| project RecommendationDisplayName, Total, RecommendationLink, PassedControls, Passed, Failed, Applicable, NotApplicable, assessmentKey\r\n| where RecommendationDisplayName contains \"account\" or RecommendationDisplayName contains \"user\" or RecommendationDisplayName contains \"identity\" or RecommendationDisplayName contains \"trust\"\r\n| where Total > 0\r\n| sort by Total, Passed desc\r\n| limit 2500\r\n", "size": 0, "showAnalytics": true, "title": "Policy Recommendations (Microsoft Defender for Cloud)", "noDataMessage": "Select Getting Started in Top Left of Workbook. Follow Guidance for Steps 2 & 5", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationDisplayName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Gear", "text": "{0}{1}" } ] } }, { "columnMatch": "Total", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "[\"Passed\"]/[\"Applicable\"]", "columnSettings": [ { "columnName": "Passed", "color": "green" }, { "columnName": "Failed", "color": "redBright" }, { "columnName": "NotApplicable", "color": "gray" } ] } } }, { "columnMatch": "RecommendationLink", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "Remediate >>", "bladeOpenContext": { "bladeName": "RecommendationsBlade", "extensionName": "Microsoft_Azure_Security", "bladeParameters": [ { "name": "assessmentKey", "source": "column", "value": "assessmentKey" } ] } } }, { "columnMatch": "PassedControls", "formatter": 5, "numberFormat": { "unit": 1, "options": { "style": "decimal", "useGrouping": true, "minimumIntegerDigits": 2, "minimumFractionDigits": 2, "maximumFractionDigits": 2, "minimumSignificantDigits": 2, "maximumSignificantDigits": 4 } } }, { "columnMatch": "Passed", "formatter": 5 }, { "columnMatch": "Failed", "formatter": 5 }, { "columnMatch": "Applicable", "formatter": 5 }, { "columnMatch": "NotApplicable", "formatter": 5 }, { "columnMatch": "assessmentKey", "formatter": 5 } ], "rowLimit": 2500, "filter": true }, "sortBy": [] }, "customWidth": "50", "name": "query - 6 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let FailedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where AnalyzeResult == \"Failed\"\r\n| summarize FailedAssets = makelist(Computer) by Description;\r\nlet PassedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where AnalyzeResult == \"Passed\"\r\n| summarize PassedAssets = makelist(Computer) by Description;\r\nSecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| summarize\r\n Failed = countif(AnalyzeResult == \"Failed\"),\r\n Passed = countif(AnalyzeResult == \"Passed\"),\r\n Total = countif(AnalyzeResult == \"Failed\" or AnalyzeResult == \"Passed\")\r\n by Description\r\n| extend PassedControls = (Passed / todouble(Total)) * 100\r\n| join kind=fullouter(FailedAssets) on Description\r\n| join kind=fullouter(PassedAssets) on Description\r\n| project Description, Total, PassedControls, Passed, Failed, PassedAssets, FailedAssets\r\n| where Description contains \"account\" or Description contains \"user\" or Description contains \"identity\" or Description contains \"trust\"\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Review Security Baselines (Microsoft Defender for Cloud)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationDisplayName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Gear", "text": "{0}{1}" } ] } }, { "columnMatch": "Total", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "Passed", "color": "green" }, { "columnName": "Failed", "color": "redBright" } ] } } }, { "columnMatch": "PassedControls", "formatter": 0, "numberFormat": { "unit": 1, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, { "columnMatch": "ControlNumber", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "AllServices", "text": "{0}{1}" } ] } }, { "columnMatch": "RecommendationState", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "!=", "thresholdValue": "Healthy", "representation": "3", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "blue" } } ], "filter": true } }, "customWidth": "50", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| where Description contains \"account\" or Description contains \"user\" or Description contains \"identity\" or Description contains \"trust\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * '/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, Severity, IncidentUrl, IncidentNumber, FirstActivityTime, IncidentBlade\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Incidents (Microsoft Sentinel)", "noDataMessage": "No Incidents Observed Within These Thresholds. Review MITRE ATT&CK Blade for Coverage Assessment", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Incident Name", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Alert", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "Sev0", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "Sev1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "Sev2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Sev3", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "Incident >>", "bladeOpenContext": { "bladeName": "CaseBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "id", "source": "column", "value": "IncidentBlade" } ] } } }, { "columnMatch": "IncidentBlade", "formatter": 5 } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let LastObserved = SigninLogs\r\n| where ResultType == 0\r\n| summarize arg_max(TimeGenerated, *) by UserPrincipalName\r\n| project UserPrincipalName, LastSignIn=TimeGenerated;\r\nSigninLogs\r\n| extend UserProfile = strcat(\"https://portal.azure.com/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/\", UserId)\r\n| where ResultType == 0\r\n| summarize count() by UserPrincipalName, UserType, UserProfile, UserId\r\n| join (LastObserved) on UserPrincipalName\r\n| join (IdentityInfo | extend UserPrincipalName = MailAddress| summarize arg_max(TimeGenerated, *) by UserPrincipalName) on UserPrincipalName\r\n| extend GroupMemberships = strcat(GroupMembership)\r\n| extend AssignedRoles = strcat(AssignedRoles)\r\n| project UserPrincipalName, UserType, SignInCount=count_, UserProfile, GivenName, Surname, Department, EmployeeId, JobTitle, Manager, StreetAddress, City, Country, State, Phone, Tags, UserId\r\n| sort by SignInCount desc\r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "User Attributes (Microsoft Entra ID)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "SignInCount", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "UserProfile", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "AAD User Profile >>", "bladeOpenContext": { "bladeName": "UserDetailsMenuBlade", "extensionName": "Microsoft_AAD_IAM", "bladeParameters": [ { "name": "userId", "source": "column", "value": "UserId" } ] } } }, { "columnMatch": "UserId", "formatter": 5 }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true }, "sortBy": [], "mapSettings": { "locInfo": "LatLong", "locInfoColumn": "Location", "latitude": "latitude_", "longitude": "longitude_", "sizeSettings": "city_", "sizeAggregation": "Count", "labelSettings": "city_", "legendMetric": "city_", "numberOfMetrics": 100, "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "state_", "colorAggregation": "Count", "type": "heatmap", "heatmapPalette": "coldHot" } } }, "name": "query - 9" } ] }, "conditionalVisibility": { "parameterName": "isTrustVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Trust", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Credentials & Authenticators (CRED)](https://www.cisa.gov/sites/default/files/2023-08/CDM_Tech%20Volume2_v2.5.pdf)\r\nThe CDM CRED (credentials and authenticators) capability ensures that account credentials are assigned to, and are used only by, authorized users or services to access agency systems, services, and facilities. CRED binds a type of credential or authenticator to an identity established in TRUST with a level of assurance and is used to grant logical access. The CRED capability will apply only to in-scope users (employees and contractors, who will each have a PIV card). In-scope users have network accounts, where the primary control mechanism for network authentication is the Agency’s Microsoft Active Directory Implementation.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) 🔷 [SecurityBaseline](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securitybaseline) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) 🔷 [IdentityInfo](https://docs.microsoft.com/azure/azure-monitor/reference/tables/identityinfo) ✳️ [Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n\r\n### Implementation\r\n💡 [Azure Key Vault basic concepts](https://docs.microsoft.com/azure/key-vault/general/basic-concepts)
\r\n💡 [Review your security recommendations](https://docs.microsoft.com/azure/defender-for-cloud/review-security-recommendations)
\r\n💡 [Continuously export Microsoft Defender for Cloud data](https://docs.microsoft.com/azure/defender-for-cloud/continuous-export)
\r\n💡 [Apply Azure security baselines to machines](https://docs.microsoft.com/azure/defender-for-cloud/apply-security-baseline)
\r\n💡 [Investigate incidents with Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/investigate-cases)
\r\n💡 [Connect Microsoft Entra ID data to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-azure-active-directory)
\r\n💡 [What are custom security attributes in Microsoft Entra ID?](https://docs.microsoft.com/azure/active-directory/fundamentals/custom-security-attributes-overview)
\r\n\r\n### Control Assessment" }, "name": "text - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatus", "label": "Status", "type": 2, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDate", "label": "Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "Notes", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{Notes}" }, "name": "text - 1" }, { "type": 1, "content": { "json": "### Recommended Microsoft Products
\r\n" }, "name": "text - 1 - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "3c316419-bc18-41ba-a503-8e45e8f6b8f7", "linkTarget": "OpenBlade", "linkLabel": "Key Vaults", "style": "secondary", "bladeOpenContext": { "bladeName": "BrowseResource", "extensionName": "HubsExtension", "bladeParameters": [ { "name": "resourceType", "source": "static", "value": "Microsoft.KeyVault/vaults" } ] } }, { "id": "eab3f582-841d-45fb-9c29-b0cfaef3aae6", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Defender for Cloud", "style": "secondary", "bladeOpenContext": { "bladeName": "SecurityMenuBlade", "extensionName": "Microsoft_Azure_Security", "bladeParameters": [] } }, { "id": "2be002d0-10f1-4369-8dcc-386c6431e721", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Entra ID", "style": "secondary", "bladeOpenContext": { "bladeName": "ActiveDirectoryMenuBlade", "extensionName": "Microsoft_AAD_IAM", "bladeParameters": [] } } ] }, "name": "links - 2" } ] }, "name": "group - 2" } ] }, "customWidth": "50", "name": "Control Smartcard" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationDisplayName, RecommendationLink | parse RecommendationLink with * '/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName <> \"\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), NotApplicable = countif(RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\"), Applicable = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\"),Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\" or RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\") by RecommendationDisplayName\r\n| extend PassedControls = (Passed/todouble(Applicable))*100\r\n| join (CustomView) on RecommendationDisplayName\r\n| project RecommendationDisplayName, Total, RecommendationLink, PassedControls, Passed, Failed, Applicable, NotApplicable, assessmentKey\r\n| where RecommendationDisplayName contains \"access\" or RecommendationDisplayName contains \"auth\" or RecommendationDisplayName contains \"key\" or RecommendationDisplayName contains \"cert\" or RecommendationDisplayName contains \"token\"\r\n| where Total > 0\r\n| sort by Total, Passed desc\r\n| limit 2500\r\n", "size": 0, "showAnalytics": true, "title": "Policy Recommendations (Microsoft Defender for Cloud)", "noDataMessage": "Select Getting Started in Top Left of Workbook. Follow Guidance for Steps 2 & 5", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationDisplayName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Gear", "text": "{0}{1}" } ] } }, { "columnMatch": "Total", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "[\"Passed\"]/[\"Applicable\"]", "columnSettings": [ { "columnName": "Passed", "color": "green" }, { "columnName": "Failed", "color": "redBright" }, { "columnName": "NotApplicable", "color": "gray" } ] } } }, { "columnMatch": "RecommendationLink", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "Remediate >>", "bladeOpenContext": { "bladeName": "RecommendationsBlade", "extensionName": "Microsoft_Azure_Security", "bladeParameters": [ { "name": "assessmentKey", "source": "column", "value": "assessmentKey" } ] } } }, { "columnMatch": "PassedControls", "formatter": 5, "numberFormat": { "unit": 1, "options": { "style": "decimal", "useGrouping": true, "minimumIntegerDigits": 2, "minimumFractionDigits": 2, "maximumFractionDigits": 2, "minimumSignificantDigits": 2, "maximumSignificantDigits": 4 } } }, { "columnMatch": "Passed", "formatter": 5 }, { "columnMatch": "Failed", "formatter": 5 }, { "columnMatch": "Applicable", "formatter": 5 }, { "columnMatch": "NotApplicable", "formatter": 5 }, { "columnMatch": "assessmentKey", "formatter": 5 } ], "rowLimit": 2500, "filter": true }, "sortBy": [] }, "customWidth": "50", "name": "query - 6 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let FailedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where AnalyzeResult == \"Failed\"\r\n| summarize FailedAssets = makelist(Computer) by Description;\r\nlet PassedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where AnalyzeResult == \"Passed\"\r\n| summarize PassedAssets = makelist(Computer) by Description;\r\nSecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| summarize\r\n Failed = countif(AnalyzeResult == \"Failed\"),\r\n Passed = countif(AnalyzeResult == \"Passed\"),\r\n Total = countif(AnalyzeResult == \"Failed\" or AnalyzeResult == \"Passed\")\r\n by Description\r\n| extend PassedControls = (Passed / todouble(Total)) * 100\r\n| join kind=fullouter(FailedAssets) on Description\r\n| join kind=fullouter(PassedAssets) on Description\r\n| project Description, Total, PassedControls, Passed, Failed, PassedAssets, FailedAssets\r\n| where Description contains \"access\" or Description contains \"auth\" or Description contains \"key\" or Description contains \"cert\" or Description contains \"token\"\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Review Security Baselines (Microsoft Defender for Cloud)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationDisplayName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Gear", "text": "{0}{1}" } ] } }, { "columnMatch": "Total", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "Passed", "color": "green" }, { "columnName": "Failed", "color": "redBright" } ] } } }, { "columnMatch": "PassedControls", "formatter": 0, "numberFormat": { "unit": 1, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, { "columnMatch": "ControlNumber", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "AllServices", "text": "{0}{1}" } ] } }, { "columnMatch": "RecommendationState", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "!=", "thresholdValue": "Healthy", "representation": "3", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "blue" } } ], "filter": true } }, "customWidth": "50", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| where Description contains \"access\" or Description contains \"auth\" or Description contains \"key\" or Description contains \"cert\" or Description contains \"token\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * '/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, Severity, IncidentUrl, IncidentNumber, FirstActivityTime, IncidentBlade\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Incidents (Microsoft Sentinel)", "noDataMessage": "No Incidents Observed Within These Thresholds. Review MITRE ATT&CK Blade for Coverage Assessment", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Incident Name", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Alert", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "Sev0", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "Sev1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "Sev2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Sev3", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "Incident >>", "bladeOpenContext": { "bladeName": "CaseBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "id", "source": "column", "value": "IncidentBlade" } ] } } }, { "columnMatch": "IncidentBlade", "formatter": 5 } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let LastObserved = SigninLogs\r\n| where ResultType == 0\r\n| summarize arg_max(TimeGenerated, *) by UserPrincipalName\r\n| project UserPrincipalName, LastSignIn=TimeGenerated;\r\nSigninLogs\r\n| extend UserProfile = strcat(\"https://portal.azure.com/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/\", UserId)\r\n| where ResultType == 0\r\n| summarize count() by UserPrincipalName, UserType, UserProfile, UserId\r\n| join (LastObserved) on UserPrincipalName\r\n| join (IdentityInfo | extend UserPrincipalName = MailAddress| summarize arg_max(TimeGenerated, *) by UserPrincipalName) on UserPrincipalName\r\n| extend GroupMemberships = strcat(GroupMembership)\r\n| extend AssignedRoles = strcat(AssignedRoles)\r\n| project UserPrincipalName, UserType, SignInCount=count_, UserProfile, Tags, LastSignIn, UserId\r\n| sort by SignInCount desc\r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "User Credentials (Microsoft Entra ID)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "SignInCount", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "UserProfile", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "AAD User Profile >>", "bladeOpenContext": { "bladeName": "UserDetailsMenuBlade", "extensionName": "Microsoft_AAD_IAM", "bladeParameters": [ { "name": "userId", "source": "column", "value": "UserId" } ] } } }, { "columnMatch": "UserId", "formatter": 5 }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true }, "sortBy": [], "mapSettings": { "locInfo": "LatLong", "locInfoColumn": "Location", "latitude": "latitude_", "longitude": "longitude_", "sizeSettings": "city_", "sizeAggregation": "Count", "labelSettings": "city_", "legendMetric": "city_", "numberOfMetrics": 100, "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "state_", "colorAggregation": "Count", "type": "heatmap", "heatmapPalette": "coldHot" } } }, "name": "query - 9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "resources\r\n| where type contains \"key\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc", "size": 0, "showAnalytics": true, "title": "Secrets Management (Key Vault)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. ", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "filter": true } }, "customWidth": "50", "name": "query - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Authenticator Management -- Leverage Authenticator Tooling", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "a32b5156-4cec-481d-83b3-165ca9208301", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Entra ID: Password Protection (Banned Passwords)", "style": "secondary", "bladeOpenContext": { "bladeName": "PasswordProtectionBlade", "extensionName": "Microsoft_AAD_IAM", "bladeParameters": [] } }, { "id": "27d9b4d1-fc6b-4813-b851-f8bd130d0be5", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Entra ID: Authenticator Management", "style": "secondary", "bladeOpenContext": { "bladeName": "AuthenticationMethodsMenuBlade", "extensionName": "Microsoft_AAD_IAM", "bladeParameters": [] } }, { "id": "d1f6bb1b-7fa4-49cf-91cd-2f67465563aa", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Entra ID: Conditional Access", "style": "secondary", "bladeOpenContext": { "bladeName": "ConditionalAccessBlade", "extensionName": "Microsoft_AAD_IAM", "bladeParameters": [] } } ] }, "name": "links - 1" } ] }, "customWidth": "50", "name": "group - 2" } ] }, "conditionalVisibility": { "parameterName": "isCredVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Cred", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Privileges (PRIV)](https://www.cisa.gov/sites/default/files/2023-08/CDM_Tech%20Volume2_v2.5.pdf)\r\nThe CDM PRIV capability provides the agency with insight into risks associated with authorized users being granted excessive privileges to systems and information at any level of sensitivity. The purpose of the capability is to ensure that privileges for logical access are assigned to authorized people or accounts that require authorized access for job functions. This capability is dependent on the existence of a set of attributes that denote roles or characteristics that require or restrict specific privileges per policy. Non-person entities are not covered by PRIV. The PRIV capability will apply only to in-scope users (employees and contractors, who will each have a PIV card) and associated accounts.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) 🔷 [SecurityBaseline](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securitybaseline) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) 🔷 [IdentityInfo](https://docs.microsoft.com/azure/azure-monitor/reference/tables/identityinfo) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\r\n\r\n### Implementation\r\n💡 [What is Microsoft Entra ID Privileged Identity Management?](https://docs.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure)
\r\n💡 [Review your security recommendations](https://docs.microsoft.com/azure/defender-for-cloud/review-security-recommendations)
\r\n💡 [Continuously export Microsoft Defender for Cloud data](https://docs.microsoft.com/azure/defender-for-cloud/continuous-export)
\r\n💡 [Apply Azure security baselines to machines](https://docs.microsoft.com/azure/defender-for-cloud/apply-security-baseline)
\r\n💡 [Investigate incidents with Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/investigate-cases)
\r\n💡 [Connect Microsoft Entra ID data to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-azure-active-directory)
\r\n💡 [What are custom security attributes in Microsoft Entra ID?](https://docs.microsoft.com/azure/active-directory/fundamentals/custom-security-attributes-overview)
\r\n\r\n### Control Assessment" }, "name": "text - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatus", "label": "Status", "type": 2, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDate", "label": "Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "Notes", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{Notes}" }, "name": "text - 1" }, { "type": 1, "content": { "json": "### Recommended Microsoft Products
\r\n" }, "name": "text - 1 - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "3c316419-bc18-41ba-a503-8e45e8f6b8f7", "linkTarget": "OpenBlade", "linkLabel": "Privileged Identity Management", "style": "secondary", "bladeOpenContext": { "bladeName": "CommonMenuBlade", "extensionName": "Microsoft_Azure_PIMCommon", "bladeParameters": [] } }, { "id": "eab3f582-841d-45fb-9c29-b0cfaef3aae6", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Defender for Cloud", "style": "secondary", "bladeOpenContext": { "bladeName": "SecurityMenuBlade", "extensionName": "Microsoft_Azure_Security", "bladeParameters": [] } }, { "id": "2be002d0-10f1-4369-8dcc-386c6431e721", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Entra ID", "style": "secondary", "bladeOpenContext": { "bladeName": "ActiveDirectoryMenuBlade", "extensionName": "Microsoft_AAD_IAM", "bladeParameters": [] } } ] }, "name": "links - 2" } ] }, "name": "group - 2" } ] }, "customWidth": "50", "name": "Control Smartcard" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationDisplayName, RecommendationLink | parse RecommendationLink with * '/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName <> \"\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), NotApplicable = countif(RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\"), Applicable = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\"),Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\" or RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\") by RecommendationDisplayName\r\n| extend PassedControls = (Passed/todouble(Applicable))*100\r\n| join (CustomView) on RecommendationDisplayName\r\n| project RecommendationDisplayName, Total, RecommendationLink, PassedControls, Passed, Failed, Applicable, NotApplicable, assessmentKey\r\n| where RecommendationDisplayName contains \"priv\" or RecommendationDisplayName contains \"admin\" or RecommendationDisplayName contains \"root\"\r\n| where Total > 0\r\n| sort by Total, Passed desc\r\n| limit 2500\r\n", "size": 0, "showAnalytics": true, "title": "Policy Recommendations (Microsoft Defender for Cloud)", "noDataMessage": "Select Getting Started in Top Left of Workbook. Follow Guidance for Steps 2 & 5", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationDisplayName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Gear", "text": "{0}{1}" } ] } }, { "columnMatch": "Total", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "[\"Passed\"]/[\"Applicable\"]", "columnSettings": [ { "columnName": "Passed", "color": "green" }, { "columnName": "Failed", "color": "redBright" }, { "columnName": "NotApplicable", "color": "gray" } ] } } }, { "columnMatch": "RecommendationLink", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "Remediate >>", "bladeOpenContext": { "bladeName": "RecommendationsBlade", "extensionName": "Microsoft_Azure_Security", "bladeParameters": [ { "name": "assessmentKey", "source": "column", "value": "assessmentKey" } ] } } }, { "columnMatch": "PassedControls", "formatter": 5, "numberFormat": { "unit": 1, "options": { "style": "decimal", "useGrouping": true, "minimumIntegerDigits": 2, "minimumFractionDigits": 2, "maximumFractionDigits": 2, "minimumSignificantDigits": 2, "maximumSignificantDigits": 4 } } }, { "columnMatch": "Passed", "formatter": 5 }, { "columnMatch": "Failed", "formatter": 5 }, { "columnMatch": "Applicable", "formatter": 5 }, { "columnMatch": "NotApplicable", "formatter": 5 }, { "columnMatch": "assessmentKey", "formatter": 5 } ], "rowLimit": 2500, "filter": true }, "sortBy": [] }, "customWidth": "50", "name": "query - 6 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let FailedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where AnalyzeResult == \"Failed\"\r\n| summarize FailedAssets = makelist(Computer) by Description;\r\nlet PassedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where AnalyzeResult == \"Passed\"\r\n| summarize PassedAssets = makelist(Computer) by Description;\r\nSecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| summarize\r\n Failed = countif(AnalyzeResult == \"Failed\"),\r\n Passed = countif(AnalyzeResult == \"Passed\"),\r\n Total = countif(AnalyzeResult == \"Failed\" or AnalyzeResult == \"Passed\")\r\n by Description\r\n| extend PassedControls = (Passed / todouble(Total)) * 100\r\n| join kind=fullouter(FailedAssets) on Description\r\n| join kind=fullouter(PassedAssets) on Description\r\n| project Description, Total, PassedControls, Passed, Failed, PassedAssets, FailedAssets\r\n| where Description contains \"priv\" or Description contains \"admin\" or Description contains \"root\"\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Review Security Baselines (Microsoft Defender for Cloud)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationDisplayName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Gear", "text": "{0}{1}" } ] } }, { "columnMatch": "Total", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "Passed", "color": "green" }, { "columnName": "Failed", "color": "redBright" } ] } } }, { "columnMatch": "PassedControls", "formatter": 0, "numberFormat": { "unit": 1, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, { "columnMatch": "ControlNumber", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "AllServices", "text": "{0}{1}" } ] } }, { "columnMatch": "RecommendationState", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "!=", "thresholdValue": "Healthy", "representation": "3", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "blue" } } ], "filter": true } }, "customWidth": "50", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| where Description contains \"priv\" or Description contains \"admin\" or Description contains \"root\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * '/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, Severity, IncidentUrl, IncidentNumber, FirstActivityTime, IncidentBlade\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Incidents (Microsoft Sentinel)", "noDataMessage": "No Incidents Observed Within These Thresholds. Review MITRE ATT&CK Blade for Coverage Assessment", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Incident Name", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Alert", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "Sev0", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "Sev1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "Sev2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Sev3", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "Incident >>", "bladeOpenContext": { "bladeName": "CaseBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "id", "source": "column", "value": "IncidentBlade" } ] } } }, { "columnMatch": "IncidentBlade", "formatter": 5 } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let LastObserved = SigninLogs\r\n| where ResultType == 0\r\n| summarize arg_max(TimeGenerated, *) by UserPrincipalName\r\n| project UserPrincipalName, LastSignIn=TimeGenerated;\r\nSigninLogs\r\n| extend UserProfile = strcat(\"https://portal.azure.com/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/\", UserId)\r\n| where ResultType == 0\r\n| summarize count() by UserPrincipalName, UserType, UserProfile, UserId\r\n| join (LastObserved) on UserPrincipalName\r\n| join (IdentityInfo | extend UserPrincipalName = MailAddress| summarize arg_max(TimeGenerated, *) by UserPrincipalName) on UserPrincipalName\r\n| extend GroupMemberships = strcat(GroupMembership)\r\n| extend AssignedRoles = strcat(AssignedRoles)\r\n| project UserPrincipalName, UserType, SignInCount=count_, UserProfile, AssignedRoles, GroupMemberships, UserId\r\n| sort by SignInCount desc\r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "User Privileges (Microsoft Entra ID)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "UserPrincipalName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "SignInCount", "formatter": 4, "formatOptions": { "palette": "blue" } }, { "columnMatch": "UserProfile", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "AAD User Profile >>", "bladeOpenContext": { "bladeName": "UserDetailsMenuBlade", "extensionName": "Microsoft_AAD_IAM", "bladeParameters": [ { "name": "userId", "source": "column", "value": "UserId" } ] } } }, { "columnMatch": "UserId", "formatter": 5 }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true }, "sortBy": [], "mapSettings": { "locInfo": "LatLong", "locInfoColumn": "Location", "latitude": "latitude_", "longitude": "longitude_", "sizeSettings": "city_", "sizeAggregation": "Count", "labelSettings": "city_", "legendMetric": "city_", "numberOfMetrics": 100, "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "state_", "colorAggregation": "Count", "type": "heatmap", "heatmapPalette": "coldHot" } } }, "name": "query - 9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| where OperationName contains \"PIM\"\r\n| extend InitiatedBy = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)\r\n| distinct OperationName, Identity, AADOperationType, InitiatedBy, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Privileged Identity Management", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "OperationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "pending", "text": "{0}{1}" } ] } }, { "columnMatch": "Identity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "InitiatedBy", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "PersonWithFriend", "text": "{0}{1}" } ] } }, { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Gear", "text": "{0}{1}" } ] } }, { "columnMatch": "Total", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "Passed", "color": "green" }, { "columnName": "Failed", "color": "redBright" } ] } } }, { "columnMatch": "PassedControls", "formatter": 0, "numberFormat": { "unit": 1, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, { "columnMatch": "RecommendationLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "" } }, { "columnMatch": "ComplianceDomain", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Persistence", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_thresholds_InitiatedBy_3", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_thresholds_InitiatedBy_3", "sortOrder": 2 } ], "mapSettings": { "locInfo": "LatLong", "locInfoColumn": "Location", "latitude": "latitude_", "longitude": "longitude_", "sizeSettings": "city_", "sizeAggregation": "Count", "labelSettings": "city_", "legendMetric": "city_", "numberOfMetrics": 100, "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "state_", "colorAggregation": "Count", "type": "heatmap", "heatmapPalette": "coldHot" } } }, "customWidth": "50", "name": "query - 9" } ] }, "conditionalVisibility": { "parameterName": "isPrivVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Priv", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "isIdentityVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Identity & Access Management" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Network Security Management](https://www.cisa.gov/sites/default/files/2023-08/CDM_Tech%20Volume2_v2.5.pdf)\r\n---\r\nThe Network Security Management (NSM) Capability Area builds on the CDM capabilities provided by Asset Management and Identity and Access Management. The NSM capabilities include network and perimeter components, host and device components, data at rest and in transit, and user behavior and activities. NSM capabilities move beyond asset management to a more extensive and dynamic monitoring of security controls. This includes preparing for and responding to behavior incidents, ensuring that software/system quality is integrated into the network/infrastructure, detecting internal actions and behaviors to determine who is doing what, and finally, mitigating security incidents to prevent propagation throughout the network/infrastructure.\r\n" }, "customWidth": "40", "name": "Common Requirements Overview" }, { "type": 1, "content": { "json": "" }, "customWidth": "60", "name": "text - 106" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t{ \\\"Control\\\": \\\"Boundary Protection (BOUND)\\\", \\\"tab\\\": \\\"Bound\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Manage Events (MNGEVT)\\\", \\\"tab\\\": \\\"Mngevt\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Endpoint Detection & Response (EDR)\\\", \\\"tab\\\": \\\"Edr\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Operate, Monitor, & Improve (OMI)\\\", \\\"tab\\\": \\\"Omi\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Design & Build in Security (DBS)\\\", \\\"tab\\\": \\\"Dbs\\\" }\\r\\n]\",\"transformers\":null}", "size": 3, "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "tab", "parameterName": "Tab", "parameterType": 1 } ], "queryType": 8, "gridSettings": { "formatters": [ { "columnMatch": "tab", "formatter": 5 } ] } }, "customWidth": "40", "name": "query - 8", "styleSettings": { "showBorder": true } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "a206a547-329b-4003-8832-c16daacca6c6", "version": "KqlParameterItem/1.0", "name": "isBoundVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "Bound", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "id": "1f176b0f-1f2f-4e12-afb0-3f10c834ef24", "version": "KqlParameterItem/1.0", "name": "isMngevtVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "Mngevt", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "id": "1f176b0f-1f2f-4e12-afb0-3f10c834ef24", "version": "KqlParameterItem/1.0", "name": "isEdrVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "Edr", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "id": "b17f2902-5d29-45b2-8712-bff5b7dd1487", "version": "KqlParameterItem/1.0", "name": "isOmiVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "Omi", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } }, { "id": "793ffbca-13bc-4fac-9535-048cbd9efc54", "version": "KqlParameterItem/1.0", "name": "isDbsVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "Dbs", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "10", "name": "Hidden Parameters Selectors" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Boundary Protection (BOUND)](https://www.cisa.gov/sites/default/files/2023-08/CDM_Tech%20Volume2_v2.5.pdf)\r\nDescribes how the network is protected through filtering, \r\nnetwork access control, and encryption.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) 🔷 [SecurityBaseline](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securitybaseline) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Implementation\r\n💡 [Azure Security Benchmark: Network Security](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security#ns-1-establish-network-segmentation-boundaries)
\r\n💡 [Deploy and configure Azure Firewall Premium](https://docs.microsoft.com/azure/firewall/premium-deploy)
\r\n💡 [Tutorial: Filter network traffic with a network security group using the Azure portal](https://docs.microsoft.com/azure/virtual-network/tutorial-filter-network-traffic)
\r\n💡 [Tutorial: Create a Web Application Firewall policy on Azure Front Door using the Azure portal](https://docs.microsoft.com/azure/web-application-firewall/afds/waf-front-door-create-portal)
\r\n💡 [What is Azure Network Watcher?](https://docs.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview)
\r\n💡 [Quickstart: Create a virtual network using the Azure portal](https://docs.microsoft.com/azure/virtual-network/quick-create-portal)
\r\n💡 [Quickstart: Deploy Azure Bastion with default settings](https://docs.microsoft.com/azure/bastion/quickstart-host-portal)
\r\n\r\n### Control Assessment" }, "name": "text - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatus", "label": "Status", "type": 2, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDate", "label": "Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "Notes", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{Notes}" }, "name": "text - 1" }, { "type": 1, "content": { "json": "### Recommended Microsoft Products
\r\n" }, "name": "text - 1 - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "3c316419-bc18-41ba-a503-8e45e8f6b8f7", "linkTarget": "OpenBlade", "linkLabel": "Azure Firewall", "style": "secondary", "bladeOpenContext": { "bladeName": "BrowseResource", "extensionName": "HubsExtension", "bladeParameters": [ { "name": "resourceType", "source": "static", "value": "Microsoft.Network/azureFirewalls" } ] } }, { "id": "eab3f582-841d-45fb-9c29-b0cfaef3aae6", "linkTarget": "OpenBlade", "linkLabel": "Network Security Groups", "style": "secondary", "bladeOpenContext": { "bladeName": "BrowseResource", "extensionName": "HubsExtension", "bladeParameters": [ { "name": "resourceType", "source": "static", "value": "Microsoft.Network/NetworkSecurityGroups" } ] } }, { "id": "3d5452e8-f52e-45d1-a761-bb6ad06b0a1b", "linkTarget": "OpenBlade", "linkLabel": "Web Application Firewalls", "style": "secondary", "bladeOpenContext": { "bladeName": "BrowseResource", "extensionName": "HubsExtension", "bladeParameters": [ { "name": "resourceType", "source": "static", "value": "Microsoft.Network/FrontDoorWebApplicationFirewallPolicies" } ] } }, { "id": "bea0a8ab-83d1-4cd9-9414-addd92325ce6", "linkTarget": "OpenBlade", "linkLabel": "Network Watcher", "style": "secondary", "bladeOpenContext": { "bladeName": "NetworkWatcherMenuBlade", "extensionName": "Microsoft_Azure_Network", "bladeParameters": [] } }, { "id": "0e8cbff6-d8ed-4374-a64b-b619d9757d88", "linkTarget": "OpenBlade", "linkLabel": "Virtual Network Gateways", "style": "secondary", "bladeOpenContext": { "bladeName": "BrowseResource", "extensionName": "HubsExtension", "bladeParameters": [ { "name": "resourceType", "source": "static", "value": "Microsoft.Network/virtualNetworkGateways" } ] } }, { "id": "0335ed7a-7ccf-4400-a87d-bc91456e7fd9", "linkTarget": "OpenBlade", "linkLabel": "Bastions", "style": "secondary", "bladeOpenContext": { "bladeName": "BrowseResource", "extensionName": "HubsExtension", "bladeParameters": [ { "name": "resourceType", "source": "static", "value": "Microsoft.Network/bastionHosts" } ] } } ] }, "name": "links - 2" } ] }, "name": "group - 2" } ] }, "customWidth": "50", "name": "Control Smartcard" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationDisplayName, RecommendationLink | parse RecommendationLink with * '/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName <> \"\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), NotApplicable = countif(RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\"), Applicable = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\"),Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\" or RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\") by RecommendationDisplayName\r\n| extend PassedControls = (Passed/todouble(Applicable))*100\r\n| join (CustomView) on RecommendationDisplayName\r\n| project RecommendationDisplayName, Total, RecommendationLink, PassedControls, Passed, Failed, Applicable, NotApplicable, assessmentKey\r\n| where RecommendationDisplayName contains \"network\" or RecommendationDisplayName contains \"internet\" or RecommendationDisplayName contains \"traffic\" or RecommendationDisplayName contains \"firewall\" or RecommendationDisplayName contains \"intrusion\" or RecommendationDisplayName contains \"bound\" or RecommendationDisplayName contains \"tls\" or RecommendationDisplayName contains \"gateway\" or RecommendationDisplayName contains \"subnet\" or RecommendationDisplayName contains \"web\" or RecommendationDisplayName contains \"url\" or RecommendationDisplayName contains \"proxy\" or RecommendationDisplayName contains \"just\" or RecommendationDisplayName contains \"port\" or RecommendationDisplayName contains \"http\"\r\n| where Total > 0\r\n| sort by Total, Passed desc\r\n| limit 2500\r\n", "size": 0, "showAnalytics": true, "title": "Policy Recommendations (Microsoft Defender for Cloud)", "noDataMessage": "Select Getting Started in Top Left of Workbook. Follow Guidance for Steps 2 & 5", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationDisplayName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Gear", "text": "{0}{1}" } ] } }, { "columnMatch": "Total", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "[\"Passed\"]/[\"Applicable\"]", "columnSettings": [ { "columnName": "Passed", "color": "green" }, { "columnName": "Failed", "color": "redBright" }, { "columnName": "NotApplicable", "color": "gray" } ] } } }, { "columnMatch": "RecommendationLink", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "Remediate >>", "bladeOpenContext": { "bladeName": "RecommendationsBlade", "extensionName": "Microsoft_Azure_Security", "bladeParameters": [ { "name": "assessmentKey", "source": "column", "value": "assessmentKey" } ] } } }, { "columnMatch": "PassedControls", "formatter": 5, "numberFormat": { "unit": 1, "options": { "style": "decimal", "useGrouping": true, "minimumIntegerDigits": 2, "minimumFractionDigits": 2, "maximumFractionDigits": 2, "minimumSignificantDigits": 2, "maximumSignificantDigits": 4 } } }, { "columnMatch": "Passed", "formatter": 5 }, { "columnMatch": "Failed", "formatter": 5 }, { "columnMatch": "Applicable", "formatter": 5 }, { "columnMatch": "NotApplicable", "formatter": 5 }, { "columnMatch": "assessmentKey", "formatter": 5 } ], "rowLimit": 2500, "filter": true }, "sortBy": [] }, "customWidth": "50", "name": "query - 6 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let FailedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where AnalyzeResult == \"Failed\"\r\n| summarize FailedAssets = makelist(Computer) by Description;\r\nlet PassedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where AnalyzeResult == \"Passed\"\r\n| summarize PassedAssets = makelist(Computer) by Description;\r\nSecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| summarize\r\n Failed = countif(AnalyzeResult == \"Failed\"),\r\n Passed = countif(AnalyzeResult == \"Passed\"),\r\n Total = countif(AnalyzeResult == \"Failed\" or AnalyzeResult == \"Passed\")\r\n by Description\r\n| extend PassedControls = (Passed / todouble(Total)) * 100\r\n| join kind=fullouter(FailedAssets) on Description\r\n| join kind=fullouter(PassedAssets) on Description\r\n| project Description, Total, PassedControls, Passed, Failed, PassedAssets, FailedAssets\r\n| where Description contains \"network\" or Description contains \"internet\" or Description contains \"traffic\" or Description contains \"firewall\" or Description contains \"intrusion\" or Description contains \"bound\" or Description contains \"tls\" or Description contains \"gateway\" or Description contains \"subnet\" or Description contains \"web\" or Description contains \"url\" or Description contains \"proxy\" or Description contains \"just\" or Description contains \"port\" or Description contains \"http\"\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Review Security Baselines (Microsoft Defender for Cloud)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationDisplayName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Gear", "text": "{0}{1}" } ] } }, { "columnMatch": "Total", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "Passed", "color": "green" }, { "columnName": "Failed", "color": "redBright" } ] } } }, { "columnMatch": "PassedControls", "formatter": 0, "numberFormat": { "unit": 1, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, { "columnMatch": "ControlNumber", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "AllServices", "text": "{0}{1}" } ] } }, { "columnMatch": "RecommendationState", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "!=", "thresholdValue": "Healthy", "representation": "3", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "blue" } } ], "filter": true } }, "customWidth": "50", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| where Description contains \"network\" or Description contains \"internet\" or Description contains \"traffic\" or Description contains \"firewall\" or Description contains \"intrusion\" or Description contains \"bound\" or Description contains \"tls\" or Description contains \"gateway\" or Description contains \"subnet\" or Description contains \"web\" or Description contains \"url\" or Description contains \"proxy\" or Description contains \"just\" or Description contains \"port\" or Description contains \"http\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * '/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, Severity, IncidentUrl, IncidentNumber, FirstActivityTime, IncidentBlade\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Incidents (Microsoft Sentinel)", "noDataMessage": "No Incidents Observed Within These Thresholds. Review MITRE ATT&CK Blade for Coverage Assessment", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Incident Name", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Alert", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "Sev0", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "Sev1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "Sev2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Sev3", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "Incident >>", "bladeOpenContext": { "bladeName": "CaseBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "id", "source": "column", "value": "IncidentBlade" } ] } } }, { "columnMatch": "IncidentBlade", "formatter": 5 } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "query - 3" } ] }, "conditionalVisibility": { "parameterName": "isBoundVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Bound", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Manage Events (MNGEVT)](https://www.cisa.gov/sites/default/files/2023-08/CDM_Tech%20Volume2_v2.5.pdf)\r\nDescribes ongoing assessment, preparing for events/incidents, audit data collection from appropriate sources, and identifying incidents through the analysis of data.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) 🔷 [SecurityBaseline](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securitybaseline) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Implementation\r\n💡 [Tutorial: Collect and analyze resource logs from an Azure resource](https://docs.microsoft.com/azure/azure-monitor/essentials/tutorial-resource-logs)
\r\n💡 [Plan your Microsoft Defender for Endpoint deployment](https://docs.microsoft.com/microsoft-365/security/defender-endpoint/deployment-strategy)
\r\n\r\n### Control Assessment" }, "name": "text - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatus", "label": "Status", "type": 2, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDate", "label": "Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "Notes", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{Notes}" }, "name": "text - 1" }, { "type": 1, "content": { "json": "### Recommended Microsoft Products
\r\n" }, "name": "text - 1 - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "bea0a8ab-83d1-4cd9-9414-addd92325ce6", "linkTarget": "OpenBlade", "linkLabel": "Azure Monitor", "style": "secondary", "bladeOpenContext": { "bladeName": "AzureMonitoringBrowseBlade", "extensionName": "Microsoft_Azure_Monitoring", "bladeParameters": [] } }, { "id": "0e8cbff6-d8ed-4374-a64b-b619d9757d88", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Defender for Endpoint", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "MicrosoftThreatProtection" } ] } } ] }, "name": "links - 2" } ] }, "name": "group - 2" } ] }, "customWidth": "50", "name": "Control Smartcard" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationDisplayName, RecommendationLink | parse RecommendationLink with * '/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName <> \"\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), NotApplicable = countif(RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\"), Applicable = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\"),Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\" or RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\") by RecommendationDisplayName\r\n| extend PassedControls = (Passed/todouble(Applicable))*100\r\n| join (CustomView) on RecommendationDisplayName\r\n| project RecommendationDisplayName, Total, RecommendationLink, PassedControls, Passed, Failed, Applicable, NotApplicable, assessmentKey\r\n| where RecommendationDisplayName contains \"event\" or RecommendationDisplayName contains \"endpoint\" or RecommendationDisplayName contains \"protection\" or RecommendationDisplayName contains \"agent\" or RecommendationDisplayName contains \"incident\" or RecommendationDisplayName contains \"back\" or RecommendationDisplayName contains \"privacy\" or RecommendationDisplayName contains \"audit\" or RecommendationDisplayName contains \"collect\"\r\n| where Total > 0\r\n| sort by Total, Passed desc\r\n| limit 2500\r\n", "size": 0, "showAnalytics": true, "title": "Policy Recommendations (Microsoft Defender for Cloud)", "noDataMessage": "Select Getting Started in Top Left of Workbook. Follow Guidance for Steps 2 & 5", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationDisplayName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Gear", "text": "{0}{1}" } ] } }, { "columnMatch": "Total", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "[\"Passed\"]/[\"Applicable\"]", "columnSettings": [ { "columnName": "Passed", "color": "green" }, { "columnName": "Failed", "color": "redBright" }, { "columnName": "NotApplicable", "color": "gray" } ] } } }, { "columnMatch": "RecommendationLink", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "Remediate >>", "bladeOpenContext": { "bladeName": "RecommendationsBlade", "extensionName": "Microsoft_Azure_Security", "bladeParameters": [ { "name": "assessmentKey", "source": "column", "value": "assessmentKey" } ] } } }, { "columnMatch": "PassedControls", "formatter": 5, "numberFormat": { "unit": 1, "options": { "style": "decimal", "useGrouping": true, "minimumIntegerDigits": 2, "minimumFractionDigits": 2, "maximumFractionDigits": 2, "minimumSignificantDigits": 2, "maximumSignificantDigits": 4 } } }, { "columnMatch": "Passed", "formatter": 5 }, { "columnMatch": "Failed", "formatter": 5 }, { "columnMatch": "Applicable", "formatter": 5 }, { "columnMatch": "NotApplicable", "formatter": 5 }, { "columnMatch": "assessmentKey", "formatter": 5 } ], "rowLimit": 2500, "filter": true }, "sortBy": [] }, "customWidth": "50", "name": "query - 6 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let FailedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where AnalyzeResult == \"Failed\"\r\n| summarize FailedAssets = makelist(Computer) by Description;\r\nlet PassedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where AnalyzeResult == \"Passed\"\r\n| summarize PassedAssets = makelist(Computer) by Description;\r\nSecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| summarize\r\n Failed = countif(AnalyzeResult == \"Failed\"),\r\n Passed = countif(AnalyzeResult == \"Passed\"),\r\n Total = countif(AnalyzeResult == \"Failed\" or AnalyzeResult == \"Passed\")\r\n by Description\r\n| extend PassedControls = (Passed / todouble(Total)) * 100\r\n| join kind=fullouter(FailedAssets) on Description\r\n| join kind=fullouter(PassedAssets) on Description\r\n| project Description, Total, PassedControls, Passed, Failed, PassedAssets, FailedAssets\r\n| where Description contains \"event\" or Description contains \"endpoint\" or Description contains \"protection\" or Description contains \"agent\" or Description contains \"incident\" or Description contains \"back\" or Description contains \"privacy\" or Description contains \"audit\" or Description contains \"collect\"\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Review Security Baselines (Microsoft Defender for Cloud)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationDisplayName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Gear", "text": "{0}{1}" } ] } }, { "columnMatch": "Total", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "Passed", "color": "green" }, { "columnName": "Failed", "color": "redBright" } ] } } }, { "columnMatch": "PassedControls", "formatter": 0, "numberFormat": { "unit": 1, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, { "columnMatch": "ControlNumber", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "AllServices", "text": "{0}{1}" } ] } }, { "columnMatch": "RecommendationState", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "!=", "thresholdValue": "Healthy", "representation": "3", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "blue" } } ], "filter": true } }, "customWidth": "50", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| where Description contains \"event\" or Description contains \"endpoint\" or Description contains \"protection\" or Description contains \"agent\" or Description contains \"incident\" or Description contains \"back\" or Description contains \"privacy\" or Description contains \"audit\" or Description contains \"collect\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * '/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, Severity, IncidentUrl, IncidentNumber, FirstActivityTime, IncidentBlade\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Incidents (Microsoft Sentinel)", "noDataMessage": "No Incidents Observed Within These Thresholds. Review MITRE ATT&CK Blade for Coverage Assessment", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Incident Name", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Alert", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "Sev0", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "Sev1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "Sev2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Sev3", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "Incident >>", "bladeOpenContext": { "bladeName": "CaseBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "id", "source": "column", "value": "IncidentBlade" } ] } } }, { "columnMatch": "IncidentBlade", "formatter": 5 } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "query - 3" } ] }, "conditionalVisibility": { "parameterName": "isMngevtVisible", "comparison": "isEqualTo", "value": "true" }, "name": "MNGEVT", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Endpoint Detection & Response (EDR)](https://www.cisa.gov/sites/default/files/2023-08/CDM_Tech%20Volume2_v2.5.pdf)\r\nThe EDR capability provides cybersecurity monitoring and control of endpoint devices.29 EDR spans the full cybersecurity lifecycle, from the detection of events (observable occurrences in a network or system) and incidents (events that have been determined to have an impact on the organization, prompting the need for response and recovery) on endpoint devices (i.e., workstations, servers, laptops, thin clients, and virtual desktops) and users, to attack responses and incident follow-up and analysis.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) 🔷 [DeviceEvents](https://docs.microsoft.com/azure/azure-monitor/reference/tables/deviceevents) 🔷 [DeviceNetworkEvents](https://docs.microsoft.com/azure/azure-monitor/reference/tables/devicenetworkevents) 🔷 [DeviceLogonEvents](https://docs.microsoft.com/azure/azure-monitor/reference/tables/devicelogonevents) 🔷 [DeviceFileEvents](https://docs.microsoft.com/azure/azure-monitor/reference/tables/devicefileevents)🔷 [DeviceRegistryEvents](https://docs.microsoft.com/azure/azure-monitor/reference/tables/deviceregistryevents) 🔷 [DeviceProcessEvents](https://docs.microsoft.com/azure/azure-monitor/reference/tables/deviceprocessevents) ✳️ [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender)
\r\n\r\n### Implementation\r\n💡 [Microsoft 365 Defender integration with Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/microsoft-365-defender-sentinel-integration)
\r\n💡 [Connect data from Microsoft 365 Defender to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-microsoft-365-defender?tabs=MDE)
\r\n\r\n### Control Assessment" }, "name": "text - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatus", "label": "Status", "type": 2, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDate", "label": "Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "Notes", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{Notes}" }, "name": "text - 1" }, { "type": 1, "content": { "json": "### Recommended Microsoft Products
\r\n" }, "name": "text - 1 - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "0e8cbff6-d8ed-4374-a64b-b619d9757d88", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Defender for Endpoint", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "MicrosoftThreatProtection" } ] } } ] }, "name": "links - 2" } ] }, "name": "group - 2" } ] }, "customWidth": "50", "name": "Control Smartcard" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationDisplayName, RecommendationLink | parse RecommendationLink with * '/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName <> \"\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), NotApplicable = countif(RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\"), Applicable = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\"),Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\" or RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\") by RecommendationDisplayName\r\n| extend PassedControls = (Passed/todouble(Applicable))*100\r\n| join (CustomView) on RecommendationDisplayName\r\n| project RecommendationDisplayName, Total, RecommendationLink, PassedControls, Passed, Failed, Applicable, NotApplicable, assessmentKey\r\n| where RecommendationDisplayName contains \"edr\" or RecommendationDisplayName contains \"malware\" or RecommendationDisplayName contains \"endpoint protection\" or RecommendationDisplayName contains \"detect\"\r\n| where Total > 0\r\n| sort by Total, Passed desc\r\n| limit 2500\r\n", "size": 0, "showAnalytics": true, "title": "Policy Recommendations (Microsoft Defender for Cloud)", "noDataMessage": "Select Getting Started in Top Left of Workbook. Follow Guidance for Steps 2 & 5", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationDisplayName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Gear", "text": "{0}{1}" } ] } }, { "columnMatch": "Total", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "[\"Passed\"]/[\"Applicable\"]", "columnSettings": [ { "columnName": "Passed", "color": "green" }, { "columnName": "Failed", "color": "redBright" }, { "columnName": "NotApplicable", "color": "gray" } ] } } }, { "columnMatch": "RecommendationLink", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "Remediate >>", "bladeOpenContext": { "bladeName": "RecommendationsBlade", "extensionName": "Microsoft_Azure_Security", "bladeParameters": [ { "name": "assessmentKey", "source": "column", "value": "assessmentKey" } ] } } }, { "columnMatch": "PassedControls", "formatter": 5, "numberFormat": { "unit": 1, "options": { "style": "decimal", "useGrouping": true, "minimumIntegerDigits": 2, "minimumFractionDigits": 2, "maximumFractionDigits": 2, "minimumSignificantDigits": 2, "maximumSignificantDigits": 4 } } }, { "columnMatch": "Passed", "formatter": 5 }, { "columnMatch": "Failed", "formatter": 5 }, { "columnMatch": "Applicable", "formatter": 5 }, { "columnMatch": "NotApplicable", "formatter": 5 }, { "columnMatch": "assessmentKey", "formatter": 5 } ], "rowLimit": 2500, "filter": true }, "sortBy": [] }, "customWidth": "50", "name": "query - 6 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| extend SystemAlertId = tostring(AlertIds[0])\r\n| join kind=fullouter (SecurityAlert) on SystemAlertId\r\n| where ProductName == \"Microsoft Defender Advanced Threat Protection\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * '/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, Severity, IncidentUrl, IncidentNumber, FirstActivityTime, IncidentBlade\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Incidents (Microsoft Sentinel + Microsoft Defender for Endpoint)", "noDataMessage": "No Incidents Observed Within These Thresholds. Review MITRE ATT&CK Blade for Coverage Assessment", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Incident Name", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Alert", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "Sev0", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "Sev1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "Sev2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Sev3", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "Incident >>", "bladeOpenContext": { "bladeName": "CaseBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "id", "source": "column", "value": "IncidentBlade" } ] } } }, { "columnMatch": "IncidentBlade", "formatter": 5 } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DeviceEvents\r\n| project DeviceName, ActionType, InitiatingProcessFileName, InitiatingProcessAccountName, AdditionalFields, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Device Events (Microsoft Defender for Endpoint)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 5 - Copy", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DeviceFileEvents\r\n| project DeviceName, ActionType, FileName, FolderPath, InitiatingProcessAccountName, InitiatingProcessParentFileName, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Device File Events (Microsoft Defender for Endpoint)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "DeviceLogonEvents\r\n| project AccountName, AccountDomain, ActionType, DeviceName, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Device Logon Events (Microsoft Defender for Endpoint)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } } ], "filter": true } }, "customWidth": "50", "name": "query - 5 - Copy", "styleSettings": { "maxWidth": "50" } } ] }, "conditionalVisibility": { "parameterName": "isEdrVisible", "comparison": "isEqualTo", "value": "true" }, "name": "EDR", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Operate, Monitor, & Improve (OMI)](https://www.cisa.gov/sites/default/files/2023-08/CDM_Tech%20Volume2_v2.5.pdf)\r\nDescribes ongoing authorization, audit data \r\naggregation/correlation and analysis, incident prioritization and response, and post-incident activities (e.g., information sharing).\r\n\r\n### Recommended Logs\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/SecurityRegulatoryCompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Implementation\r\n💡 [Tutorial: Improve your regulatory compliance](https://docs.microsoft.com/azure/defender-for-cloud/regulatory-compliance-dashboard)
\r\n💡 [Details of the NIST SP 800-53 Regulatory Compliance built-in initiative](https://docs.microsoft.com/azure/governance/policy/samples/nist-sp-800-53-r4)
\r\n\r\n### Control Assessment" }, "name": "text - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatus", "label": "Status", "type": 2, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDate", "label": "Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "Notes", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{Notes}" }, "name": "text - 1" }, { "type": 1, "content": { "json": "### Recommended Microsoft Products
\r\n" }, "name": "text - 1 - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "3c316419-bc18-41ba-a503-8e45e8f6b8f7", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Sentinel", "style": "secondary", "bladeOpenContext": { "bladeName": "BrowseResource", "extensionName": "HubsExtension", "bladeParameters": [ { "name": "resourceType", "source": "static", "value": "microsoft.securityinsightsarg/sentinel" } ] } }, { "id": "eab3f582-841d-45fb-9c29-b0cfaef3aae6", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Defender for Cloud", "style": "secondary", "bladeOpenContext": { "bladeName": "SecurityMenuBlade", "extensionName": "Microsoft_Azure_Security", "bladeParameters": [] } } ] }, "name": "links - 2" } ] }, "name": "group - 2" } ] }, "customWidth": "50", "name": "Control Smartcard" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"NIST SP 800 53 R4\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"NIST SP 800 53 R4\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), NotApplicable = countif(state == \"NotApplicable\"), Applicable = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\"),Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\" or state == \"NotApplicable\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Applicable))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"NIST SP 800 53 R4\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName\r\n | where ControlID contains \"SI.\"\r\n | distinct RecommendationName, ControlID, Total, RecommendationLink, PassedControls, Passed, Failed, NotApplicable, Applicable, name\r\n | sort by Total, Passed desc\r\n | limit 250", "size": 0, "showAnalytics": true, "title": "NIST SP 800-53: System & Information Integrity (Microsoft Defender for Cloud)", "noDataMessage": "Select Getting Started in Top Left of Workbook. Follow Guidance for Steps 3-5", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Gear", "text": "{0}{1}" } ] } }, { "columnMatch": "Total", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "[\"Passed\"]/[\"Applicable\"]", "columnSettings": [ { "columnName": "Passed", "color": "green" }, { "columnName": "Failed", "color": "redBright" }, { "columnName": "NotApplicable", "color": "gray" } ] } } }, { "columnMatch": "RecommendationLink", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "Remediate >>", "linkIsContextBlade": false, "bladeOpenContext": { "bladeName": "RecommendationsBlade", "extensionName": "Microsoft_Azure_Security", "bladeParameters": [ { "name": "assessmentKey", "source": "column", "value": "name" } ] } } }, { "columnMatch": "PassedControls", "formatter": 5, "numberFormat": { "unit": 1, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } } }, { "columnMatch": "Passed", "formatter": 5 }, { "columnMatch": "Failed", "formatter": 5 }, { "columnMatch": "NotApplicable", "formatter": 5 }, { "columnMatch": "Applicable", "formatter": 5 }, { "columnMatch": "name", "formatter": 5 } ], "filter": true }, "sortBy": [] }, "customWidth": "50", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"NIST SP 800 53 R4\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"NIST SP 800 53 R4\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), NotApplicable = countif(state == \"NotApplicable\"), Applicable = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\"),Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\" or state == \"NotApplicable\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Applicable))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"NIST SP 800 53 R4\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName\r\n | where ControlID contains \"RA.\"\r\n | distinct RecommendationName, ControlID, Total, RecommendationLink, PassedControls, Passed, Failed, NotApplicable, Applicable, name\r\n | sort by Total, Passed desc\r\n | limit 250", "size": 0, "showAnalytics": true, "title": "NIST SP 800-53: Risk Assessment (Microsoft Defender for Cloud)", "noDataMessage": "Select Getting Started in Top Left of Workbook. Follow Guidance for Steps 3-5", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Gear", "text": "{0}{1}" } ] } }, { "columnMatch": "Total", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "[\"Passed\"]/[\"Applicable\"]", "columnSettings": [ { "columnName": "Passed", "color": "green" }, { "columnName": "Failed", "color": "redBright" }, { "columnName": "NotApplicable", "color": "gray" } ] } } }, { "columnMatch": "RecommendationLink", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "Remediate >>", "linkIsContextBlade": false, "bladeOpenContext": { "bladeName": "RecommendationsBlade", "extensionName": "Microsoft_Azure_Security", "bladeParameters": [ { "name": "assessmentKey", "source": "column", "value": "name" } ] } } }, { "columnMatch": "PassedControls", "formatter": 5, "numberFormat": { "unit": 1, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } } }, { "columnMatch": "Passed", "formatter": 5 }, { "columnMatch": "Failed", "formatter": 5 }, { "columnMatch": "NotApplicable", "formatter": 5 }, { "columnMatch": "Applicable", "formatter": 5 }, { "columnMatch": "name", "formatter": 5 } ], "filter": true }, "sortBy": [] }, "customWidth": "50", "name": "query - 3 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"NIST SP 800 53 R4\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"NIST SP 800 53 R4\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), NotApplicable = countif(state == \"NotApplicable\"), Applicable = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\"),Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\" or state == \"NotApplicable\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Applicable))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"NIST SP 800 53 R4\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName\r\n | where ControlID contains \"CA.\"\r\n | distinct RecommendationName, ControlID, Total, RecommendationLink, PassedControls, Passed, Failed, NotApplicable, Applicable, name\r\n | sort by Total, Passed desc\r\n | limit 250", "size": 0, "showAnalytics": true, "title": "NIST SP 800-53: Security & Assessment (Microsoft Defender for Cloud)", "noDataMessage": "Select Getting Started in Top Left of Workbook. Follow Guidance for Steps 3-5", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Gear", "text": "{0}{1}" } ] } }, { "columnMatch": "Total", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "[\"Passed\"]/[\"Applicable\"]", "columnSettings": [ { "columnName": "Passed", "color": "green" }, { "columnName": "Failed", "color": "redBright" }, { "columnName": "NotApplicable", "color": "gray" } ] } } }, { "columnMatch": "RecommendationLink", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "Remediate >>", "linkIsContextBlade": false, "bladeOpenContext": { "bladeName": "RecommendationsBlade", "extensionName": "Microsoft_Azure_Security", "bladeParameters": [ { "name": "assessmentKey", "source": "column", "value": "name" } ] } } }, { "columnMatch": "PassedControls", "formatter": 5, "numberFormat": { "unit": 1, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } } }, { "columnMatch": "Passed", "formatter": 5 }, { "columnMatch": "Failed", "formatter": 5 }, { "columnMatch": "NotApplicable", "formatter": 5 }, { "columnMatch": "Applicable", "formatter": 5 }, { "columnMatch": "name", "formatter": 5 } ], "filter": true }, "sortBy": [] }, "customWidth": "50", "name": "query - 3 - Copy - Copy" } ] }, "conditionalVisibility": { "parameterName": "isOmiVisible", "comparison": "isEqualTo", "value": "true" }, "name": "OMI", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Design & Build in Security (DBS)](https://www.cisa.gov/sites/default/files/2023-08/CDM_Tech%20Volume2_v2.5.pdf)\r\nDescribes preventing exploitable vulnerabilities from being \r\neffective in the software/system while the software/system is in development or \r\ndeployment.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) 🔷 [SecurityNestedRecommendation](https://docs.microsoft.com/azure/defender-for-iot/how-to-security-data-access#security-recommendations) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [GitHubAuditLogPolling_CL](https://portal.azure.com/#create/microsoftcorporation1622712991604.sentinel4githubsentinel4github) 🔷 [AzureDevOpsAuditing](https://docs.microsoft.com/azure/devops/organizations/audit/auditing-streaming) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n\r\n### Implementation\r\n💡 [Azure DevOps - audit streaming](https://docs.microsoft.com/azure/devops/organizations/audit/auditing-streaming?view=azure-devops&preserve-view=true)
\r\n💡 [GitHub logging](https://docs.github.com/organizations/keeping-your-organization-secure/reviewing-the-audit-log-for-your-organization)
\r\n💡 [Protecting your GitHub assets with Microsoft Sentinel](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/protecting-your-github-assets-with-azure-sentinel/ba-p/1457721)
\r\n💡 [Deploy Microsoft Sentinel: Continuous Threat Monitoring for GitHub Solution](https://portal.azure.com/#create/microsoftcorporation1622712991604.sentinel4githubsentinel4github)
\r\n💡 [DAST tools in Azure DevOps marketplace](https://marketplace.visualstudio.com/search?term=DAST&target=AzureDevOps&category=All%20categories)
\r\n💡 [How to Implement Microsoft Defender for Cloud Vulnerability Assessment Recommendations](https://docs.microsoft.com/azure/security-center/deploy-vulnerability-assessment-vm)
\r\n💡 [Integrated Vulnerability Scanner for Virtual Machines](https://docs.microsoft.com/azure/security-center/deploy-vulnerability-assessment-vm)
\r\n💡 [SQL Vulnerability Assessment](https://docs.microsoft.com/azure/azure-sql/database/sql-vulnerability-assessment)
\r\n💡 [Exporting Microsoft Defender for Cloud Vulnerability Scan Results](https://docs.microsoft.com/azure/security-center/continuous-export)
\r\n\r\n### Control Assessment" }, "name": "text - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatus", "label": "Status", "type": 2, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDate", "label": "Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "Notes", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{Notes}" }, "name": "text - 1" }, { "type": 1, "content": { "json": "### Recommended Microsoft Products
\r\n" }, "name": "text - 1 - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "3c316419-bc18-41ba-a503-8e45e8f6b8f7", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Sentinel", "style": "secondary", "bladeOpenContext": { "bladeName": "BrowseResource", "extensionName": "HubsExtension", "bladeParameters": [ { "name": "resourceType", "source": "static", "value": "microsoft.securityinsightsarg/sentinel" } ] } }, { "id": "eab3f582-841d-45fb-9c29-b0cfaef3aae6", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Defender for Cloud", "style": "secondary", "bladeOpenContext": { "bladeName": "SecurityMenuBlade", "extensionName": "Microsoft_Azure_Security", "bladeParameters": [] } } ] }, "name": "links - 2" } ] }, "name": "group - 2" } ] }, "customWidth": "50", "name": "Control Smartcard" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationDisplayName, RecommendationLink | parse RecommendationLink with * '/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName <> \"\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), NotApplicable = countif(RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\"), Applicable = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\"),Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\" or RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\") by RecommendationDisplayName\r\n| extend PassedControls = (Passed/todouble(Applicable))*100\r\n| join (CustomView) on RecommendationDisplayName\r\n| project RecommendationDisplayName, Total, RecommendationLink, PassedControls, Passed, Failed, Applicable, NotApplicable, assessmentKey\r\n| where RecommendationDisplayName contains \"aks\" or RecommendationDisplayName contains \"contain\" or RecommendationDisplayName contains \"kube\" or RecommendationDisplayName contains \"supply\"\r\n| where Total > 0\r\n| sort by Total, Passed desc\r\n| limit 2500\r\n", "size": 0, "showAnalytics": true, "title": "Policy Recommendations (Microsoft Defender for Cloud)", "noDataMessage": "Select Getting Started in Top Left of Workbook. Follow Guidance for Steps 2 & 5", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationDisplayName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Gear", "text": "{0}{1}" } ] } }, { "columnMatch": "Total", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "[\"Passed\"]/[\"Applicable\"]", "columnSettings": [ { "columnName": "Passed", "color": "green" }, { "columnName": "Failed", "color": "redBright" }, { "columnName": "NotApplicable", "color": "gray" } ] } } }, { "columnMatch": "RecommendationLink", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "Remediate >>", "bladeOpenContext": { "bladeName": "RecommendationsBlade", "extensionName": "Microsoft_Azure_Security", "bladeParameters": [ { "name": "assessmentKey", "source": "column", "value": "assessmentKey" } ] } } }, { "columnMatch": "PassedControls", "formatter": 5, "numberFormat": { "unit": 1, "options": { "style": "decimal", "useGrouping": true, "minimumIntegerDigits": 2, "minimumFractionDigits": 2, "maximumFractionDigits": 2, "minimumSignificantDigits": 2, "maximumSignificantDigits": 4 } } }, { "columnMatch": "Passed", "formatter": 5 }, { "columnMatch": "Failed", "formatter": 5 }, { "columnMatch": "Applicable", "formatter": 5 }, { "columnMatch": "NotApplicable", "formatter": 5 }, { "columnMatch": "assessmentKey", "formatter": 5 } ], "rowLimit": 2500, "filter": true }, "sortBy": [] }, "customWidth": "50", "name": "query - 6 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\r\n| where Tactics <> \"[]\"\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by Tactics\r\n| render timechart \r\n", "size": 0, "showAnalytics": true, "title": "Threat Modeling: MITRE ATT&CK® Tactics Observed (Microsoft Sentinel)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationDisplayName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Gear", "text": "{0}{1}" } ] } }, { "columnMatch": "Total", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "Passed", "color": "green" }, { "columnName": "Failed", "color": "redBright" } ] } } }, { "columnMatch": "PassedControls", "formatter": 0, "numberFormat": { "unit": 1, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, { "columnMatch": "ControlNumber", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "AllServices", "text": "{0}{1}" } ] } }, { "columnMatch": "RecommendationState", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "!=", "thresholdValue": "Healthy", "representation": "3", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "blue" } } ], "filter": true } }, "customWidth": "50", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "GitHubAuditLogPolling_CL \r\n| project actor_s, org_s, repo_s, action_s, name_s, _document_id_s, visibility_s, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "Audit Logs (GitHub)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "actor_s", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "action_s", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Gear", "text": "{0}{1}" } ] } }, { "columnMatch": "RecommendationDisplayName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Gear", "text": "{0}{1}" } ] } }, { "columnMatch": "Total", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "Passed", "color": "green" }, { "columnName": "Failed", "color": "redBright" } ] } } }, { "columnMatch": "PassedControls", "formatter": 0, "numberFormat": { "unit": 1, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, { "columnMatch": "ControlNumber", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "AllServices", "text": "{0}{1}" } ] } }, { "columnMatch": "RecommendationState", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "!=", "thresholdValue": "Healthy", "representation": "3", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "blue" } } ], "filter": true } }, "customWidth": "50", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureDevOpsAuditing\r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "Audit Logs (Azure DevOps)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationDisplayName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Gear", "text": "{0}{1}" } ] } }, { "columnMatch": "Total", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "Passed", "color": "green" }, { "columnName": "Failed", "color": "redBright" } ] } } }, { "columnMatch": "PassedControls", "formatter": 0, "numberFormat": { "unit": 1, "options": { "style": "decimal", "maximumFractionDigits": 2 } } }, { "columnMatch": "ControlNumber", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "AllServices", "text": "{0}{1}" } ] } }, { "columnMatch": "RecommendationState", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "!=", "thresholdValue": "Healthy", "representation": "3", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "blue" } } ], "filter": true } }, "customWidth": "50", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityNestedRecommendation\r\n| extend CVE = tostring(parse_json(tostring(AdditionalData.Cve))[0].Title)\r\n| where Description <> \"\"\r\n| where Description <> \"N/A\"\r\n| summarize count() by Description, CVE\r\n| sort by count_ desc\r\n| project Description, CVE, count_\r\n| limit 250", "size": 0, "showAnalytics": true, "title": " System/Application Vulnerabilities (Microsoft Defender for Cloud)", "noDataMessage": "Confirm ASC SecurityNestedRecommendation logging is enabled and/or extend time thresholds for a larger data-set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Execution", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "ComplianceDomain", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Persistence", "text": "{0}{1}" } ] } }, { "columnMatch": "Total", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "Passed", "color": "green" }, { "columnName": "Failed", "color": "redBright" } ] } } }, { "columnMatch": "PassedControls", "formatter": 0, "numberFormat": { "unit": 1, "options": { "style": "decimal", "maximumFractionDigits": 2 } } } ], "filter": true } }, "customWidth": "50", "name": "query - 6" } ] }, "conditionalVisibility": { "parameterName": "isDbsVisible", "comparison": "isEqualTo", "value": "true" }, "name": "DBS", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "isNetworkVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Network Security Management" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Data Protection Management](https://www.cisa.gov/sites/default/files/2023-08/CDM_Tech%20Volume2_v2.5.pdf)\r\n---\r\nData Protection Management (DPM) Capability Area focuses on “How is data protected?” and builds on the CDM capabilities provided by Asset Management, Identity and Access Management, and Network Security Management.\r\n" }, "customWidth": "40", "name": "Common Requirements Overview" }, { "type": 1, "content": { "json": "" }, "customWidth": "60", "name": "text - 106" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t{ \\\"Control\\\": \\\"Data Protection Management\\\", \\\"tab\\\": \\\"All\\\" }\\r\\n]\",\"transformers\":null}", "size": 3, "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "tab", "parameterName": "Tab", "parameterType": 1 } ], "queryType": 8, "gridSettings": { "formatters": [ { "columnMatch": "tab", "formatter": 5 } ] } }, "customWidth": "40", "name": "query - 8", "styleSettings": { "showBorder": true } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "a206a547-329b-4003-8832-c16daacca6c6", "version": "KqlParameterItem/1.0", "name": "isAllVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "Tab", "operator": "contains", "rightValType": "static", "rightVal": "All", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "rightValType": "param", "resultValType": "static", "resultVal": "false" } } ], "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "10", "name": "Hidden Parameters Selectors" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Data Protection Management](https://www.cisa.gov/sites/default/files/2023-08/CDM_Tech%20Volume2_v2.5.pdf)\r\nData Protection Management (DPM) Capability Area focuses on “How is data protected?” and builds on the CDM capabilities provided by Asset Management, Identity and Access Management, and Network Security Management.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [InformationProtectionLogs_CL](https://docs.microsoft.com/azure/information-protection/audit-logs) ✳️ [Azure Information Protection](https://azure.microsoft.com/services/information-protection/)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Key Vault](https://azure.microsoft.com/services/key-vault/)
\r\n\r\n### Implementation\r\n💡 [Data classification overview](https://docs.microsoft.com/azure/cloud-adoption-framework/govern/policy-compliance/data-classification)
\r\n💡 [Label your sensitive data using Azure Purview](https://docs.microsoft.com/azure/purview/create-sensitivity-label)
\r\n💡 [Tag Sensitive Information Using Azure Information Protection](https://docs.microsoft.com/azure/information-protection/what-is-information-protection)
\r\n💡 [How to implement Azure SQL Data Discovery](https://docs.microsoft.com/azure/azure-sql/database/data-discovery-and-classification-overview)
\r\n💡 [Azure Purview data sources](https://docs.microsoft.com/azure/purview/purview-connector-overview#purview-data-sources)
\r\n💡 [Azure Key Vault overview](https://docs.microsoft.com/azure/key-vault/general/overview)
\r\n💡 [BYOK (Bring Your Own Key) specification](https://docs.microsoft.com/azure/key-vault/keys/byok-specification)
\r\n\r\n### Control Assessment" }, "name": "text - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", "version": "KqlParameterItem/1.0", "name": "ImplementationStatus", "label": "Status", "type": 2, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", "timeContext": { "durationMs": 86400000 } }, { "id": "578b8620-30b9-4b92-abc6-997998bc8156", "version": "KqlParameterItem/1.0", "name": "ImplementationDate", "label": "Date", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 } }, { "version": "KqlParameterItem/1.0", "name": "Notes", "type": 1, "value": "", "timeContext": { "durationMs": 86400000 }, "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Status" }, { "type": 1, "content": { "json": "### Notes
\r\n{Notes}" }, "name": "text - 1" }, { "type": 1, "content": { "json": "### Recommended Microsoft Products
\r\n" }, "name": "text - 1 - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "3c316419-bc18-41ba-a503-8e45e8f6b8f7", "linkTarget": "OpenBlade", "linkLabel": "Microsoft Sentinel", "style": "secondary", "bladeOpenContext": { "bladeName": "BrowseResource", "extensionName": "HubsExtension", "bladeParameters": [ { "name": "resourceType", "source": "static", "value": "microsoft.securityinsightsarg/sentinel" } ] } }, { "id": "eab3f582-841d-45fb-9c29-b0cfaef3aae6", "linkTarget": "OpenBlade", "linkLabel": "Azure Information Protection", "style": "secondary", "bladeOpenContext": { "bladeName": "DataClassGroupEditBlade", "extensionName": "Microsoft_Azure_InformationProtection", "bladeParameters": [] } }, { "id": "e4385e0c-e410-4d0e-8fc6-d5c6fe97c0ec", "linkTarget": "OpenBlade", "linkLabel": "Key Vault", "style": "secondary", "bladeOpenContext": { "bladeName": "BrowseResource", "extensionName": "HubsExtension", "bladeParameters": [ { "name": "resourceType", "source": "static", "value": "Microsoft.KeyVault/vaults" } ] } } ] }, "name": "links - 2" } ] }, "name": "group - 2" } ] }, "customWidth": "50", "name": "Control Smartcard" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationDisplayName, RecommendationLink | parse RecommendationLink with * '/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName <> \"\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), NotApplicable = countif(RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\"), Applicable = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\"),Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\" or RecommendationState == \"NotApplicable\" or RecommendationState == \"Removed\") by RecommendationDisplayName\r\n| extend PassedControls = (Passed/todouble(Applicable))*100\r\n| join (CustomView) on RecommendationDisplayName\r\n| project RecommendationDisplayName, Total, RecommendationLink, PassedControls, Passed, Failed, Applicable, NotApplicable, assessmentKey\r\n| where RecommendationDisplayName contains \"data\" or RecommendationDisplayName contains \"storage\" or RecommendationDisplayName contains \"sql\" or RecommendationDisplayName contains \"cmk\" or RecommendationDisplayName contains \"key\"\r\n| where Total > 0\r\n| sort by Total, Passed desc\r\n| limit 2500\r\n", "size": 0, "showAnalytics": true, "title": "Policy Recommendations (Microsoft Defender for Cloud)", "noDataMessage": "Select Getting Started in Top Left of Workbook. Follow Guidance for Steps 2 & 5", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "RecommendationDisplayName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Gear", "text": "{0}{1}" } ] } }, { "columnMatch": "Total", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "[\"Passed\"]/[\"Applicable\"]", "columnSettings": [ { "columnName": "Passed", "color": "green" }, { "columnName": "Failed", "color": "redBright" }, { "columnName": "NotApplicable", "color": "gray" } ] } } }, { "columnMatch": "RecommendationLink", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "Remediate >>", "bladeOpenContext": { "bladeName": "RecommendationsBlade", "extensionName": "Microsoft_Azure_Security", "bladeParameters": [ { "name": "assessmentKey", "source": "column", "value": "assessmentKey" } ] } } }, { "columnMatch": "PassedControls", "formatter": 5, "numberFormat": { "unit": 1, "options": { "style": "decimal", "useGrouping": true, "minimumIntegerDigits": 2, "minimumFractionDigits": 2, "maximumFractionDigits": 2, "minimumSignificantDigits": 2, "maximumSignificantDigits": 4 } } }, { "columnMatch": "Passed", "formatter": 5 }, { "columnMatch": "Failed", "formatter": 5 }, { "columnMatch": "Applicable", "formatter": 5 }, { "columnMatch": "NotApplicable", "formatter": 5 }, { "columnMatch": "assessmentKey", "formatter": 5 } ], "rowLimit": 2500, "filter": true }, "sortBy": [] }, "customWidth": "50", "name": "query - 6 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| where Description contains \"data\" or Description contains \"storage\" or Description contains \"sql\" or Description contains \"cmk\" or Description contains \"key\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * '/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, Severity, IncidentUrl, IncidentNumber, FirstActivityTime, IncidentBlade\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Incidents (Microsoft Sentinel)", "noDataMessage": "No Incidents Observed Within These Thresholds. Review MITRE ATT&CK Blade for Coverage Assessment", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Incident Name", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Alert", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "Sev0", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "Sev1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "Sev2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Sev3", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "Incident >>", "bladeOpenContext": { "bladeName": "CaseBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "id", "source": "column", "value": "IncidentBlade" } ] } } }, { "columnMatch": "IncidentBlade", "formatter": 5 } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "InformationProtectionLogs_CL\r\n| extend AIP = strcat(\"https://portal.azure.com/#blade/Microsoft_Azure_InformationProtection/DataClassGroupEditBlade/ActivityLogsBlade\")\r\n| summarize count() by LabelName_s, AIP\r\n| sort by count_ desc\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Data Discovery/Classification (Azure Information Protection)", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "LabelName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "2", "text": "{0}{1}" } ] } }, { "columnMatch": "AIP", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "Azure Information Protection >>", "bladeOpenContext": { "bladeName": "DataClassGroupEditBlade", "extensionName": "Microsoft_Azure_InformationProtection", "bladeParameters": [] } } }, { "columnMatch": "User", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "ProtectionOwner", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "PersonWithFriend", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "orange" } }, { "columnMatch": "UserId_s", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "3", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "ProductName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Alert >" } }, { "columnMatch": "UPN", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "2", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Incident >" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true }, "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "blueDark" } ] } } }, "customWidth": "50", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Run query to see results.\r\nresources\r\n| where type =~ 'Microsoft.KeyVault/vaults'\r\n| project name,resourceGroup,location,id,type,subscriptionId,kind,tags\r\n| extend typeDisplayName=case(type =~ 'microsoft.keyvault/vaults','Key vault',type)\r\n| extend locationDisplayName=case(location =~ 'eastus','East US',location =~ 'eastus2','East US 2',location =~ 'southcentralus','South Central US',location =~ 'westus2','West US 2',location =~ 'westus3','West US 3',location =~ 'australiaeast','Australia East',location =~ 'southeastasia','Southeast Asia',location =~ 'northeurope','North Europe',location =~ 'swedencentral','Sweden Central',location =~ 'uksouth','UK South',location =~ 'westeurope','West Europe',location =~ 'centralus','Central US',location =~ 'northcentralus','North Central US',location =~ 'westus','West US',location =~ 'southafricanorth','South Africa North',location =~ 'centralindia','Central India',location =~ 'eastasia','East Asia',location =~ 'japaneast','Japan East',location =~ 'jioindiawest','Jio India West',location =~ 'koreacentral','Korea Central',location =~ 'canadacentral','Canada Central',location =~ 'francecentral','France Central',location =~ 'germanywestcentral','Germany West Central',location =~ 'norwayeast','Norway East',location =~ 'switzerlandnorth','Switzerland North',location =~ 'uaenorth','UAE North',location =~ 'brazilsouth','Brazil South',location =~ 'centralusstage','Central US (Stage)',location =~ 'eastusstage','East US (Stage)',location =~ 'eastus2stage','East US 2 (Stage)',location =~ 'northcentralusstage','North Central US (Stage)',location =~ 'southcentralusstage','South Central US (Stage)',location =~ 'westusstage','West US (Stage)',location =~ 'westus2stage','West US 2 (Stage)',location =~ 'asia','Asia',location =~ 'asiapacific','Asia Pacific',location =~ 'australia','Australia',location =~ 'brazil','Brazil',location =~ 'canada','Canada',location =~ 'europe','Europe',location =~ 'france','France',location =~ 'germany','Germany',location =~ 'global','Global',location =~ 'india','India',location =~ 'japan','Japan',location =~ 'korea','Korea',location =~ 'norway','Norway',location =~ 'southafrica','South Africa',location =~ 'switzerland','Switzerland',location =~ 'uae','United Arab Emirates',location =~ 'uk','United Kingdom',location =~ 'unitedstates','United States',location =~ 'eastasiastage','East Asia (Stage)',location =~ 'southeastasiastage','Southeast Asia (Stage)',location =~ 'westcentralus','West Central US',location =~ 'southafricawest','South Africa West',location =~ 'australiacentral','Australia Central',location =~ 'australiacentral2','Australia Central 2',location =~ 'australiasoutheast','Australia Southeast',location =~ 'japanwest','Japan West',location =~ 'jioindiacentral','Jio India Central',location =~ 'koreasouth','Korea South',location =~ 'southindia','South India',location =~ 'westindia','West India',location =~ 'canadaeast','Canada East',location =~ 'francesouth','France South',location =~ 'germanynorth','Germany North',location =~ 'norwaywest','Norway West',location =~ 'switzerlandwest','Switzerland West',location =~ 'ukwest','UK West',location =~ 'uaecentral','UAE Central',location =~ 'brazilsoutheast','Brazil Southeast',location)\r\n| extend tagsString=tostring(tags)\r\n| where (type !~ ('dynatrace.observability/monitors'))\r\n| where (type !~ ('nginx.nginxplus/nginxdeployments'))\r\n| where (type !~ ('microsoft.agfoodplatform/farmbeats'))\r\n| where (type !~ ('microsoft.cdn/profiles/afdendpoints'))\r\n| where (type !~ ('microsoft.cdn/profiles/customdomains'))\r\n| where (type !~ ('microsoft.cdn/profiles/origingroups'))\r\n| where (type !~ ('microsoft.cdn/profiles/rulesets'))\r\n| where (type !~ ('microsoft.cdn/profiles/secrets'))\r\n| where (type !~ ('microsoft.cdn/profiles/securitypolicies'))\r\n| where (type !~ ('microsoft.cdn/profiles/afdendpoints/routes'))\r\n| where (type !~ ('microsoft.cdn/profiles/origingroups/origins'))\r\n| where (type !~ ('microsoft.cdn/profiles/rulesets/rules'))\r\n| where (type !~ ('microsoft.kubernetes/connectedclusters/microsoft.kubernetesconfiguration/fluxconfigurations'))\r\n| where (type !~ ('microsoft.containerservice/managedclusters/microsoft.kubernetesconfiguration/fluxconfigurations'))\r\n| where (type !~ ('microsoft.portal/extensions/deployments'))\r\n| where (type !~ ('microsoft.portal/extensions'))\r\n| where (type !~ ('microsoft.portal/extensions/slots'))\r\n| where (type !~ ('microsoft.portal/extensions/versions'))\r\n| where (type !~ ('microsoft.datacollaboration/workspaces'))\r\n| where (type !~ ('microsoft.network/dnsforwardingrulesets'))\r\n| where (type !~ ('microsoft.network/dnsresolvers'))\r\n| where (type !~ ('microsoft.azurestack/registrations'))\r\n| where (type !~ ('microsoft.communication/emailservices'))\r\n| where (type !~ ('microsoft.hdinsight/clusterpools/clusters'))\r\n| where (type !~ ('microsoft.hdinsight/clusterpools/clusters/sessionclusters'))\r\n| where (type !~ ('microsoft.hdinsight/clusterpools'))\r\n| where (type !~ ('microsoft.hpcworkbench/instances'))\r\n| where (type !~ ('microsoft.scvmm/vmmservers'))\r\n| where (type !~ ('microsoft.connectedvmwarevsphere/vcenters'))\r\n| where (type !~ ('microsoft.intelligentitdigitaltwin/digitaltwins/assets'))\r\n| where (type !~ ('microsoft.intelligentitdigitaltwin/digitaltwins/tests'))\r\n| where (type !~ ('microsoft.intelligentitdigitaltwin/digitaltwins/executionplans'))\r\n| where (type !~ ('microsoft.intelligentitdigitaltwin/digitaltwins/testplans'))\r\n| where (type !~ ('microsoft.intelligentitdigitaltwin/digitaltwins'))\r\n| where not((type =~ ('microsoft.network/serviceendpointpolicies')) and ((kind =~ ('internal'))))\r\n| where (type !~ ('microsoft.openlogisticsplatform/workspaces'))\r\n| where (type !~ ('microsoft.scom/managedinstances'))\r\n| where (type !~ ('microsoft.orbital/spacecrafts/contacts'))\r\n| where (type !~ ('microsoft.orbital/contactprofiles'))\r\n| where (type !~ ('microsoft.orbital/edgesites'))\r\n| where (type !~ ('microsoft.orbital/groundstations'))\r\n| where (type !~ ('microsoft.orbital/l2connections'))\r\n| where (type !~ ('microsoft.orbital/spacecrafts'))\r\n| where (type !~ ('microsoft.azurepercept/accounts'))\r\n| where (type !~ ('microsoft.workloads/phpworkloads'))\r\n| where (type !~ ('microsoft.playfab/playeraccountpools'))\r\n| where (type !~ ('microsoft.playfab/playfabresources'))\r\n| where (type !~ ('microsoft.playfab/titles'))\r\n| where (type !~ ('microsoft.recommendationsservice/accounts/modeling'))\r\n| where (type !~ ('microsoft.recommendationsservice/accounts/serviceendpoints'))\r\n| where (type !~ ('microsoft.recoveryservicesbvtd2/vaults'))\r\n| where (type !~ ('microsoft.recoveryservicesbvtd/vaults'))\r\n| where (type !~ ('microsoft.recoveryservicesintd/vaults'))\r\n| where (type !~ ('microsoft.recoveryservicesintd2/vaults'))\r\n| where (type !~ ('microsoft.workloads/sapvirtualinstances/applicationinstances'))\r\n| where (type !~ ('microsoft.workloads/sapvirtualinstances/centralinstances'))\r\n| where (type !~ ('microsoft.workloads/sapvirtualinstances/databaseinstances'))\r\n| where (type !~ ('microsoft.workloads/sapvirtualinstances'))\r\n| where (type !~ ('microsoft.datareplication/replicationvaults'))\r\n| where (type !~ ('microsoft.storagecache/amlfilesystems'))\r\n| where not((type =~ ('microsoft.synapse/workspaces/sqlpools')) and ((kind =~ ('v3'))))\r\n| where (type !~ ('microsoft.mobilenetwork/mobilenetworks'))\r\n| where (type !~ ('microsoft.mobilenetwork/mobilenetworks/sites'))\r\n| where (type !~ ('microsoft.mobilenetwork/packetcorecontrolplanes'))\r\n| where (type !~ ('microsoft.mobilenetwork/mobilenetworks/services'))\r\n| where (type !~ ('microsoft.mobilenetwork/sims'))\r\n| where (type !~ ('microsoft.workloads/monitors'))\r\n| where not((type =~ ('microsoft.sql/servers/databases')) and ((kind in~ ('system','v2.0,system','v12.0,system','v12.0,user,datawarehouse,gen2,analytics'))))\r\n| where not((type =~ ('microsoft.sql/servers')) and ((kind =~ ('v12.0,analytics'))))\r\n| project id,typeDisplayName,resourceGroup,locationDisplayName,tagsString,name,type,kind,location,subscriptionId,tags\r\n| sort by (tolower(tostring(name))) asc", "size": 0, "showAnalytics": true, "title": "Key Vault Assets", "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. ", "queryType": 1, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "filter": true } }, "name": "query - 3" } ] }, "conditionalVisibility": { "parameterName": "isAllVisible", "comparison": "isEqualTo", "value": "true" }, "name": "All", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "isDataVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Data Protection Management" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Asset / Indicator Search](https://docs.microsoft.com/azure/sentinel/understand-threat-intelligence)\r\n---\r\n\r\nThreat indicators are data that associate observed artifacts such as URLs, file hashes, or IP addresses with known threat activity such as phishing, botnets, or malware. In Microsoft Sentinel, you can use threat indicators to help detect malicious activity observed in your environment and provide context to security investigators to help inform response decisions. Indicator search provides a free-text search of indicators (Ip address, file, hash, email address, username) to determine:\r\n\r\n\t•\tIndicators in your data\r\n\t•\tPattern of the indicator over time\r\n\t•\tReporting threat intelligence feed and details\r\n\t•\tSecurity Incidents for investigation and response\r\n\r\n" }, "customWidth": "40", "name": "text - 5" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "521d368e-c46e-41b5-bea0-fd07dc96b511", "linkTarget": "OpenBlade", "linkLabel": "Threat Intelligence >>", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "ThreatIntelligenceTaxii" } ] } } ] }, "customWidth": "20", "name": "links - 8" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "9aec751b-07bd-43ba-80b9-f711887dce45", "version": "KqlParameterItem/1.0", "name": "Indicator", "label": "Indicator Search", "type": 1, "value": "", "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "Threat Research Parameters" }, { "type": 1, "content": { "json": "" }, "customWidth": "50", "name": "text - 9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Add additional lines for desired data columns\r\nunion withsource= Table_Name *\r\n| where column_ifexists('CallerIpAddress', '') has \"{Indicator}\"\r\nor column_ifexists('DestinationIP', '') has \"{Indicator}\"\r\nor column_ifexists('FileOriginUrl', '') has \"{Indicator}\"\r\nor column_ifexists('FQDN', '') has \"{Indicator}\"\r\nor column_ifexists('InitiatingProcessSHA256', '') has \"{Indicator}\"\r\nor column_ifexists('IpAddress', '') has \"{Indicator}\"\r\nor column_ifexists('IPAddresses', '') has \"{Indicator}\"\r\nor column_ifexists('IPAddress', '') has \"{Indicator}\"\r\nor column_ifexists('Name', '') has \"{Indicator}\"\r\nor column_ifexists('RemoteIP', '') has \"{Indicator}\"\r\nor column_ifexists('RemoteUrl', '') has \"{Indicator}\"\r\nor column_ifexists('RecipientEmailAddress', '') has \"{Indicator}\" \r\nor column_ifexists('SenderMailFromAddress', '') has \"{Indicator}\" \r\nor column_ifexists('SourceIP', '') has \"{Indicator}\"\r\nor column_ifexists('Url', '') has \"{Indicator}\"\r\nor column_ifexists('SrcIpAddr', '') has \"{Indicator}\"\r\nor column_ifexists('DstIpAddr', '') has \"{Indicator}\"\r\nor column_ifexists('NetworkSourceIP', '') has \"{Indicator}\"\r\nor column_ifexists('FileHashValue', '') has \"{Indicator}\"\r\nor column_ifexists('NetworkIP', '') has \"{Indicator}\"\r\nor column_ifexists('NetworkDestinationIP', '') has \"{Indicator}\"\r\nor column_ifexists('EmailSourceIpAddress', '') has \"{Indicator}\"\r\nor column_ifexists('EmailSenderAddress', '') has \"{Indicator}\"\r\nor column_ifexists('DomainName', '') has \"{Indicator}\"\r\nor column_ifexists('AADEmail', '') has \"{Indicator}\"\r\nor column_ifexists('Account', '') has \"{Indicator}\"\r\nor column_ifexists('AccountName', '') has \"{Indicator}\"\r\nor column_ifexists('AccountUpn', '') has \"{Indicator}\"\r\nor column_ifexists('AccountUPN', '') has \"{Indicator}\"\r\nor column_ifexists('Caller', '') has \"{Indicator}\"\r\nor column_ifexists('CompromisedEntity', '') has \"{Indicator}\"\r\nor column_ifexists('DestinationUserID', '') has \"{Indicator}\"\r\nor column_ifexists('DestinationUserName', '') has \"{Indicator}\"\r\nor column_ifexists('DisplayName', '') has \"{Indicator}\"\r\nor column_ifexists('Email_s', '') has \"{Indicator}\"\r\nor column_ifexists('FullyQualifiedSubjectUserName', '') has \"{Indicator}\"\r\nor column_ifexists('InitiatingProcessAccountUpn', '') has \"{Indicator}\" \r\nor column_ifexists('MailboxOwnerUPN', '') has \"{Indicator}\"\r\nor column_ifexists('Owner', '') has \"{Indicator}\"\r\nor column_ifexists('RequesterUpn', '') has \"{Indicator}\"\r\nor column_ifexists('SourceIdentity', '') has \"{Indicator}\"\r\nor column_ifexists('SourceUserID', '') has \"{Indicator}\"\r\nor column_ifexists('SourceUserName', '') has \"{Indicator}\"\r\nor column_ifexists('SubjectUserName', '') has \"{Indicator}\"\r\nor column_ifexists('TargetUser', '') has \"{Indicator}\"\r\nor column_ifexists('TargetUserName', '') has \"{Indicator}\"\r\nor column_ifexists('Upn', '') has \"{Indicator}\"\r\nor column_ifexists('User_s', '') has \"{Indicator}\"\r\nor column_ifexists('UserId', '') has \"{Indicator}\" \r\nor column_ifexists('UserId_', '') has \"{Indicator}\"\r\nor column_ifexists('UserId_s_s', '') has \"{Indicator}\" \r\nor column_ifexists('userName', '') has \"{Indicator}\"\r\nor column_ifexists('UserName', '') has \"{Indicator}\" \r\nor column_ifexists('UserName_s', '') has \"{Indicator}\"\r\nor column_ifexists('userPrincipalName_s', '') has \"{Indicator}\"\r\nor column_ifexists('UserPrincipalName_s', '') has \"{Indicator}\"\r\nor column_ifexists('UserPrincipalName', '') has \"{Indicator}\"\r\nor column_ifexists('Computer', '') has \"{Indicator}\"\r\nor column_ifexists('FileHash', '') has \"{Indicator}\"\r\nor column_ifexists('FilePath', '') has \"{Indicator}\"\r\nor column_ifexists('Process', '') has \"{Indicator}\"\r\nor column_ifexists('CommandLine', '') has \"{Indicator}\"\r\nor column_ifexists('NewProcessName', '') has \"{Indicator}\"\r\nor column_ifexists('ParentProcessName', '') has \"{Indicator}\"\r\n| summarize count() by Table_Name \r\n| project-rename ['Data Table']=Table_Name, ['Logs Count']=count_\r\n| sort by ['Logs Count'] desc", "size": 0, "showAnalytics": true, "title": "Indicators Observed", "noDataMessage": "No indicators observed within these thresholds", "timeContextFromParameter": "TimeRange", "exportFieldName": "Type", "exportParameterName": "Type", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Data Table", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Log", "text": "{0}{1}" } ] } }, { "columnMatch": "Logs Count", "formatter": 4, "formatOptions": { "palette": "blue" } } ], "filter": true } }, "customWidth": "50", "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Add additional lines for desired data columns\r\nunion withsource= Table_Name *\r\n| where column_ifexists('CallerIpAddress', '') has \"{Indicator}\"\r\nor column_ifexists('DestinationIP', '') has \"{Indicator}\"\r\nor column_ifexists('FileOriginUrl', '') has \"{Indicator}\"\r\nor column_ifexists('FQDN', '') has \"{Indicator}\"\r\nor column_ifexists('InitiatingProcessSHA256', '') has \"{Indicator}\"\r\nor column_ifexists('IpAddress', '') has \"{Indicator}\"\r\nor column_ifexists('IPAddresses', '') has \"{Indicator}\"\r\nor column_ifexists('IPAddress', '') has \"{Indicator}\"\r\nor column_ifexists('Name', '') has \"{Indicator}\"\r\nor column_ifexists('RemoteIP', '') has \"{Indicator}\"\r\nor column_ifexists('RemoteUrl', '') has \"{Indicator}\"\r\nor column_ifexists('RecipientEmailAddress', '') has \"{Indicator}\" \r\nor column_ifexists('SenderMailFromAddress', '') has \"{Indicator}\" \r\nor column_ifexists('SourceIP', '') has \"{Indicator}\"\r\nor column_ifexists('Url', '') has \"{Indicator}\"\r\nor column_ifexists('SrcIpAddr', '') has \"{Indicator}\"\r\nor column_ifexists('DstIpAddr', '') has \"{Indicator}\"\r\nor column_ifexists('NetworkSourceIP', '') has \"{Indicator}\"\r\nor column_ifexists('FileHashValue', '') has \"{Indicator}\"\r\nor column_ifexists('NetworkIP', '') has \"{Indicator}\"\r\nor column_ifexists('NetworkDestinationIP', '') has \"{Indicator}\"\r\nor column_ifexists('EmailSourceIpAddress', '') has \"{Indicator}\"\r\nor column_ifexists('EmailSenderAddress', '') has \"{Indicator}\"\r\nor column_ifexists('DomainName', '') has \"{Indicator}\"\r\nor column_ifexists('AADEmail', '') has \"{Indicator}\"\r\nor column_ifexists('Account', '') has \"{Indicator}\"\r\nor column_ifexists('AccountName', '') has \"{Indicator}\"\r\nor column_ifexists('AccountUpn', '') has \"{Indicator}\"\r\nor column_ifexists('AccountUPN', '') has \"{Indicator}\"\r\nor column_ifexists('Caller', '') has \"{Indicator}\"\r\nor column_ifexists('CompromisedEntity', '') has \"{Indicator}\"\r\nor column_ifexists('DestinationUserID', '') has \"{Indicator}\"\r\nor column_ifexists('DestinationUserName', '') has \"{Indicator}\"\r\nor column_ifexists('DisplayName', '') has \"{Indicator}\"\r\nor column_ifexists('Email_s', '') has \"{Indicator}\"\r\nor column_ifexists('FullyQualifiedSubjectUserName', '') has \"{Indicator}\"\r\nor column_ifexists('InitiatingProcessAccountUpn', '') has \"{Indicator}\" \r\nor column_ifexists('MailboxOwnerUPN', '') has \"{Indicator}\"\r\nor column_ifexists('Owner', '') has \"{Indicator}\"\r\nor column_ifexists('RequesterUpn', '') has \"{Indicator}\"\r\nor column_ifexists('SourceIdentity', '') has \"{Indicator}\"\r\nor column_ifexists('SourceUserID', '') has \"{Indicator}\"\r\nor column_ifexists('SourceUserName', '') has \"{Indicator}\"\r\nor column_ifexists('SubjectUserName', '') has \"{Indicator}\"\r\nor column_ifexists('TargetUser', '') has \"{Indicator}\"\r\nor column_ifexists('TargetUserName', '') has \"{Indicator}\"\r\nor column_ifexists('Upn', '') has \"{Indicator}\"\r\nor column_ifexists('User_s', '') has \"{Indicator}\"\r\nor column_ifexists('UserId', '') has \"{Indicator}\" \r\nor column_ifexists('UserId_', '') has \"{Indicator}\"\r\nor column_ifexists('UserId_s_s', '') has \"{Indicator}\" \r\nor column_ifexists('userName', '') has \"{Indicator}\"\r\nor column_ifexists('UserName', '') has \"{Indicator}\" \r\nor column_ifexists('UserName_s', '') has \"{Indicator}\"\r\nor column_ifexists('userPrincipalName_s', '') has \"{Indicator}\"\r\nor column_ifexists('UserPrincipalName_s', '') has \"{Indicator}\"\r\nor column_ifexists('UserPrincipalName', '') has \"{Indicator}\"\r\nor column_ifexists('Computer', '') has \"{Indicator}\"\r\nor column_ifexists('FileHash', '') has \"{Indicator}\"\r\nor column_ifexists('FilePath', '') has \"{Indicator}\"\r\nor column_ifexists('Process', '') has \"{Indicator}\"\r\nor column_ifexists('CommandLine', '') has \"{Indicator}\"\r\nor column_ifexists('NewProcessName', '') has \"{Indicator}\"\r\nor column_ifexists('ParentProcessName', '') has \"{Indicator}\"\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by Type\r\n| render areachart", "size": 0, "showAnalytics": true, "title": "Indicators Observed over Time", "noDataMessage": "No indicators observed within these thresholds", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Data Table", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Log", "text": "{0}{1}" } ] } }, { "columnMatch": "Logs Count", "formatter": 4, "formatOptions": { "palette": "redBright" } } ], "filter": true } }, "customWidth": "50", "name": "query - 4 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let tiObservables = ThreatIntelligenceIndicator\r\n | where TimeGenerated < now()\r\n | project IndicatorId, ThreatType, Description, Active, IndicatorTime = TimeGenerated, Indicator = strcat(NetworkSourceIP, NetworkIP, NetworkDestinationIP, Url, FileHashValue, EmailSourceIpAddress, EmailSenderAddress, DomainName), SourceSystem;\r\nlet alertEntity = SecurityAlert \r\n | project parse_json(Entities), SystemAlertId , AlertTime = TimeGenerated\r\n | mvexpand(Entities)\r\n | extend entity = iif(isnotempty(Entities.Address), Entities.Address,\r\n iif(isnotempty(Entities.HostName),strcat(Entities.HostName, \".\", Entities.DnsDomain),\r\n iif(isnotempty(Entities.Url), Entities.Url,\r\n iif(isnotempty(Entities.Value), Entities.Value,\r\n iif(Entities.Type == \"account\", strcat(Entities.Name,\"@\",Entities.UPNSuffix),\"\")))))\r\n | where isnotempty(entity) \r\n | project entity, SystemAlertId, AlertTime;\r\nlet IncidentAlerts = SecurityIncident\r\n | project IncidentTime = TimeGenerated, IncidentNumber, Title, parse_json(AlertIds)\r\n | mv-expand AlertIds\r\n | project IncidentTime, IncidentNumber, Title, tostring(AlertIds);\r\nlet AlertsWithTiObservables = alertEntity\r\n | join kind=inner tiObservables on $left.entity == $right.Indicator;\r\nlet IncidentsWithAlertsWithTiObservables = AlertsWithTiObservables\r\n | join kind=inner IncidentAlerts on $left.SystemAlertId == $right.AlertIds;\r\nIncidentsWithAlertsWithTiObservables\r\n| where Indicator contains '{Indicator}' or Indicator == \"*\"\r\n| summarize Incidents=dcount(IncidentNumber), Alerts=dcount(SystemAlertId) by Indicator, ThreatType, Source = SourceSystem, Description\r\n| sort by Incidents, Alerts desc", "size": 0, "showAnalytics": true, "title": "Threat Intelligence Alerts", "noDataMessage": "No indicators observed within these thresholds", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "ThreatType", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Botnet", "representation": "Command and Control", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "MaliciousUrl", "representation": "Initial_Access", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Malware", "representation": "Execution", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Phishing", "representation": "Exfiltration", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Pre attack", "text": "{0}{1}" } ] } }, { "columnMatch": "Source", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "Incidents", "formatter": 4, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Alerts", "formatter": 4, "formatOptions": { "palette": "orange" } } ], "filter": true } }, "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| extend SystemAlertId = tostring(AlertIds[0])\r\n| join (SecurityAlert \r\n| where Entities <> \"\"\r\n| mv-expand parse_json(Entities)\r\n| where Entities contains '{Indicator}'\r\n| project SystemAlertId, Entities\r\n) on SystemAlertId\r\n| where Title <> \"\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * '/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, IncidentNumber desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade, Entities\r\n| limit 2500", "size": 0, "showAnalytics": true, "title": "Security Incidents", "noDataMessage": "No incidents observed within these thresholds", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Incident Name", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Alert", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "Sev0", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "Sev1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "Sev2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Sev3", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "Incident >>", "bladeOpenContext": { "bladeName": "CaseBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "id", "source": "column", "value": "IncidentBlade" } ] } } }, { "columnMatch": "IncidentBlade", "formatter": 5 } ], "rowLimit": 2500, "filter": true, "sortBy": [ { "itemKey": "IncidentNumber", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "IncidentNumber", "sortOrder": 2 } ] }, "name": "query - 3" } ] }, "name": "Indicators Observed" } ] }, "conditionalVisibility": { "parameterName": "isTIVisible", "comparison": "isEqualTo", "value": "true" }, "name": "group - 21" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Azure Lighthouse](https://azure.microsoft.com/services/azure-lighthouse/)\r\n---\r\nAzure Lighthouse helps service providers simplify customer engagement and onboarding experiences, while managing delegated resources at scale with agility and precision. Authorized users, groups, and service principals can work directly in the context of a customer subscription without having an account in that customer's Microsoft Entra ID tenant or being a co-owner of the customer's tenant. The mechanism used to support this access is called Azure delegated resource management. " }, "customWidth": "40", "name": "text - 5" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "1cf637a7-121d-4722-b511-b0c460625e31", "linkTarget": "OpenBlade", "linkLabel": "Azure Lighthouse >>", "style": "secondary", "bladeOpenContext": { "bladeName": "LighthouseBlade", "extensionName": "Microsoft_Azure_CustomerHub", "bladeParameters": [] } } ] }, "customWidth": "50", "name": "links - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "managedservicesresources\r\n| where type == \"microsoft.managedservices/registrationassignments\"\r\n| where properties.provisioningState == \"Succeeded\"\r\n| extend ManageeTenantName = properties.registrationDefinition.properties.manageeTenantName\r\n| extend ManagedByTenantName = properties.registrationDefinition.properties.managedByTenantName\r\n| extend ManagedByTenantId = properties.registrationDefinition.properties.managedByTenantId\r\n| extend ManageeTenantId = tostring(properties.registrationDefinition.properties.manageeTenantId)\r\n| extend PermanentAccess = properties.registrationDefinition.properties.authorizations\r\n| extend JITAccess = properties.registrationDefinition.properties.eligibleAuthorizations\r\n| extend AddedDate = properties.registrationDefinition.systemData.createdAt\r\n| extend CreatedBy = systemData.createdBy\r\n| project ManageeTenantName, ManageeTenantId, ManagedByTenantName, ManagedByTenantId, AddedDate, CreatedBy", "size": 1, "showAnalytics": true, "title": "Azure Lighthouse Delegations", "noDataMessage": "No Azure Lighthouse Delegations/Customers Detected", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "ManageeTenantName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Download", "text": "{0}{1}" } ] } }, { "columnMatch": "ManagedByTenantName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Upload", "text": "{0}{1}" } ] } }, { "columnMatch": "ManagedByTenantId", "formatter": 1, "formatOptions": { "linkTarget": "Resource" } }, { "columnMatch": "PermanentAccess", "formatter": 1 }, { "columnMatch": "JITAccess", "formatter": 1 }, { "columnMatch": "AddedDate", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Clock", "text": "{0}{1}" } ] } }, { "columnMatch": "CreatedBy", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Person", "text": "{0}{1}" } ] } } ], "filter": true } }, "name": "query - 21 - Copy" } ] }, "conditionalVisibility": { "parameterName": "isALVisible", "comparison": "isEqualTo", "value": "true" }, "name": "group - 21" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Recommended Data Connectors](https://docs.microsoft.com/azure/sentinel/connect-data-sources)\r\n---\r\n\r\nAfter onboarding Microsoft Sentinel into your workspace, connect data sources to start ingesting your data into Microsoft Sentinel. Microsoft Sentinel comes with many connectors for Microsoft products, available out of the box and providing real-time integration. For example, service-to-service connectors include Microsoft 365 Defender connectors and Microsoft 365 sources, such as Office 365, Microsoft Entra ID, Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps. Check out these references if you're new to Microsoft Sentinel." }, "customWidth": "40", "name": "NS Guide" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "b1cd1f8a-e807-4deb-93f4-7812e5ed014a", "linkTarget": "OpenBlade", "linkLabel": "Data Connectors >>", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorsBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [] } } ] }, "customWidth": "20", "name": "EL0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "b9a6293e-1c7b-4ec2-ad2a-d72b5ee01722", "cellValue": "https://docs.microsoft.com/azure/sentinel/best-practices", "linkTarget": "Url", "linkLabel": "Best Practices", "style": "link" }, { "id": "1bad541e-219a-4277-9510-876b0e8cad51", "cellValue": "https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/azure-sentinel-all-in-one-accelerator/ba-p/1807933", "linkTarget": "Url", "linkLabel": "Microsoft Sentinel All-In-One Accelerator", "style": "link" }, { "id": "7e8ff8aa-f632-4a4d-90cf-a71da0dc6b31", "cellValue": "https://docs.microsoft.com/learn/browse/?wt.mc_id=resilience_skilling_webpage_gdc&terms=sentinel", "linkTarget": "Url", "linkLabel": "Microsoft Sentinel Training", "style": "link" } ] }, "customWidth": "40", "name": "links - 29" } ], "exportParameters": true }, "name": "group - 7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "## Foundational Connectors", "style": "info" }, "name": "text - 13" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Azure Activity Connector](https://docs.microsoft.com/azure/azure-monitor/essentials/activity-log)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "909d0019-23cb-43ad-8285-9f1dca1cd1be", "version": "KqlParameterItem/1.0", "name": "AzureActivity", "label": "Status", "type": 1, "query": "AzureActivity\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "58cc25ab-a9af-4516-99e1-fa22e0637a76", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureActivity" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "33", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Microsoft Entra ID Connector](https://docs.microsoft.com/azure/sentinel/connect-azure-active-directory)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "23ba579d-c894-43be-9fe1-d1b04bc34d7a", "version": "KqlParameterItem/1.0", "name": "SignInLogs", "label": "Status", "type": 1, "query": "SigninLogs\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Active Directory" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "7c97e893-29f3-4d4c-a379-f220bb82518c", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureActiveDirectory" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Azure Active Directory (AAD) Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Office 365 Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#microsoft-365-formerly-office-365)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "68bd12c8-e473-45d1-8bbc-2dd9f326ea69", "version": "KqlParameterItem/1.0", "name": "OfficeActivity", "label": "Status", "type": 1, "query": "OfficeActivity\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector - Copy - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "6a86eb8d-5487-4aad-ae7b-b526e68a249f", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "Office365" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Office 365 Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Microsoft Defender for Cloud Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#tenant-based-microsoft-defender-for-cloud)\r\n\r\n" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "1673e4cf-354f-4a42-bed2-2374be47779e", "version": "KqlParameterItem/1.0", "name": "MDfC", "label": "Status", "type": 1, "query": "SecurityAlert\r\n| where ProviderName == \"Azure Security Center\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector - Copy - Copy - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "56600b70-0e55-433a-be86-b7c561bced8b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureSecurityCenter" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Microsoft Defender for Cloud Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Network Security Groups (NSG) Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#network-security-groups)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "b17ce357-e8d5-4c7c-a4f0-765598462a1c", "version": "KqlParameterItem/1.0", "name": "NSG", "label": "Status", "type": 1, "query": "AzureDiagnostics\r\n| where Category == \"NetworkSecurityGroupEvent\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "935bb630-1fce-4021-b7b4-c010b9e05973", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureNSG" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Network Security Groups (NSG) Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Windows Security Events (AMA) Connector](https://docs.microsoft.com/azure/sentinel/connect-azure-windows-microsoft-services?tabs=SA%2CAMA#windows-agent-based-connections)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "d9af27d9-8c90-4c85-a57f-f329257d9956", "version": "KqlParameterItem/1.0", "name": "AMA", "label": "Status", "type": 1, "query": "SecurityEvent\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d002eb41-c632-429b-8504-846b69314620", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "WindowsSecurityEvents" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Windows Security Events (AMA) Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Security Events via Legacy Agent Connector](https://docs.microsoft.com/azure/sentinel/connect-azure-windows-microsoft-services?tabs=SA%2CLAA#windows-agent-based-connections)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "b2737fbc-c0e2-4584-9fba-ee7d057d7db0", "version": "KqlParameterItem/1.0", "name": "SecurityEvent", "label": "Status", "type": 1, "query": "SecurityEvent\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "9a8b0649-e79b-4a30-be25-4a5486f302ee", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "SecurityEvents" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Security Events via Legacy Agent Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [DNS Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#dns)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "8b7ac3ca-b46c-43e0-ae8c-e2b5189596bc", "version": "KqlParameterItem/1.0", "name": "DNS", "label": "Status", "type": 1, "query": "DnsEvents\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "2d8731f5-c225-4a39-9914-6391b2c89ecb", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "DNS" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "DNS Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Azure Storage Accounts Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#azure-storage-account)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "4f291c03-8d98-47b6-ba82-1282322bb7a5", "version": "KqlParameterItem/1.0", "name": "StorageLogs", "label": "Status", "type": 1, "query": "StorageBlobLogs\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "6d9cd26b-3fcd-4556-b2eb-3dcb711c4de4", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureStorageAccount" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Azure Storage Logs Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Common Event Format (CEF) Connector](https://docs.microsoft.com/azure/sentinel/connect-common-event-format)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "4fcf795c-75b8-4010-bd24-1d66511ff6e8", "version": "KqlParameterItem/1.0", "name": "CommonSecurityLog", "label": "Status", "type": 1, "query": "CommonSecurityLog\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "452e02e1-b0c4-4b9b-8a54-bc9295db22b9", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "CEF" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Common Event Format (CEF) Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Syslog Connector](https://docs.microsoft.com/azure/sentinel/connect-syslog)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "fa63a08f-dd08-4e11-bcb6-c075a6d6c15c", "version": "KqlParameterItem/1.0", "name": "Syslog", "label": "Status", "type": 1, "query": "Syslog\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "021644a3-bd51-4b09-8117-017a89c71d58", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "Syslog" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Syslog Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Amazon Web Services (AWS) Connector](https://docs.microsoft.com/azure/sentinel/connect-aws?tabs=s3)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "18ed59f0-c497-44b1-94b7-8700051cf189", "version": "KqlParameterItem/1.0", "name": "AWS", "label": "Status", "type": 1, "query": "AWSCloudTrail\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "393c465e-4398-428b-8da2-87ac07d8a987", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AWS" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Amazon Web Services (AWS) Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Amazon Web Services (AWS) S3 Connector](https://docs.microsoft.com/azure/sentinel/connect-aws?tabs=s3)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "AWSS3", "label": "Status", "type": 1, "query": "AWSVPCFlow\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AwsS3" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Amazon Web Services (AWS) S3 Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Google Cloud Platform IAM Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#google-cloud-platform-iam-via-codeless-connector-framework)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "GCP", "label": "Status", "type": 1, "query": "GCP_IAM_CL\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "1f2ba663-dd7a-49b6-87ba-0b8adf6d2d34" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Amazon Web Services (AWS) S3 Connector - Copy", "styleSettings": { "showBorder": true } } ], "exportParameters": true }, "name": "group - 5", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "## Basic Connectors", "style": "info" }, "name": "text - 13" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Microsoft 365 Defender Connector](https://docs.microsoft.com/azure/sentinel/connect-microsoft-365-defender?tabs=MDE)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "M365Defender", "label": "Status", "type": 1, "query": "AlertEvidence\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "MicrosoftThreatProtection" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Microsoft 365 Defender Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Microsoft Defender for Endpoint Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#microsoft-defender-for-endpoint)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "MDE", "label": "Status", "type": 1, "query": "SecurityAlert\r\n| where ProviderName == \"MDATP\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "MicrosoftDefenderAdvancedThreatProtection" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Microsoft 365 Defender Connector - Copy", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Azure Firewall Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#azure-firewall)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "AzureFirewall", "label": "Status", "type": 1, "query": "AzureDiagnostics\r\n| where ResourceType == \"AZUREFIREWALLS\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureFirewall" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Azure Firewall Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Windows Firewall Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#windows-firewall)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "WindowsFirewall", "label": "Status", "type": 1, "query": "WindowsFirewall\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "WindowsFirewall" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Windows Firewall Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Azure Web Application Firewall Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#azure-web-application-firewall-waf)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "AzureWAF", "label": "Status", "type": 1, "query": "AzureDiagnostics | where ResourceType in (\"APPLICATIONGATEWAYS\", \"FRONTDOORS\", \"CDNWEBAPPLICATIONFIREWALLPOLICIES\", \"PROFILES\")\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "WAF" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Azure Web Application Firewall Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Azure SQL Databases Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#azure-sql-databases)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "8b7ac3ca-b46c-43e0-ae8c-e2b5189596bc", "version": "KqlParameterItem/1.0", "name": "SQL", "label": "Status", "type": 1, "query": "AzureDiagnostics | where Category contains \"SQL\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "2d8731f5-c225-4a39-9914-6391b2c89ecb", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureSql" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "SQL Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Azure Key Vault Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#azure-key-vault)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "AzureKeyVault", "label": "Status", "type": 1, "query": "AzureDiagnostics | where ResourceProvider == \"MICROSOFT.KEYVAULT\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureKeyVault" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Azure Key Vault Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Azure DDoS Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#azure-ddos-protection)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "DDoS", "label": "Status", "type": 1, "query": "AzureDiagnostics | where ResourceType == \"PUBLICIPADDRESSES\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "Azure Activity Connector - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "DDOS" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Azure DDoS Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [VMware Carbon Black Cloud via AWS S3](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#vmware-carbon-black-cloud-via-aws-s3)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "VMwareCarbon", "label": "Status", "type": 1, "query": "CarbonBlack_Alerts_CL\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "VMwareESXi" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "VMware ESXi Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Microsoft Defender for Cloud: Continuous Export](https://docs.microsoft.com/azure/defender-for-cloud/continuous-export?tabs=azure-portal)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "SecurityRecommendation", "label": "Status", "type": 1, "query": "SecurityRecommendation\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Feature", "style": "secondary", "bladeOpenContext": { "bladeName": "SecurityMenuBlade", "extensionName": "Microsoft_Azure_Security", "bladeParameters": [] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Continuous Export Connector", "styleSettings": { "showBorder": true } } ], "exportParameters": true }, "name": "group - 6", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "## Intermediate Connectors", "style": "info" }, "name": "text - 13" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Microsoft Purview Information Protection](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#microsoft-purview-information-protection)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "MicrosoftPurviewInformationProtection", "type": 1, "query": "MicrosoftPurviewInformationProtection\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "label": "Status" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureInformationProtection" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Azure Information Protection Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Dynamics 365 Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#dynamics365)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "Dynamics365Activity", "label": "Status", "type": 1, "query": "Dynamics365Activity\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "Dynamics365" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Dynamics 365 Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Azure Kubernetes Service (AKS) Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#azure-kubernetes-service-aks)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "AKS", "label": "Status", "type": 1, "query": "AzureDiagnostics\r\n| where Category == \"kube-audit\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureKubernetes" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Azure Kubernetes Service (AKS) Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Qualys Vulnerability Management Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#qualys-vulnerability-management-via-codeless-connector-framework)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "Qualys", "label": "Status", "type": 1, "query": "QualysHostDetectionV3_CL\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "QualysVulnerabilityManagement" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Qualys Vulnerability Management Connector", "styleSettings": { "showBorder": true } } ], "exportParameters": true }, "name": "group - 6" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "## Advanced Connectors", "style": "info" }, "name": "text - 13" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Entity Behavior (UEBA)](https://docs.microsoft.com/azure/sentinel/enable-entity-behavior-analytics)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "BehaviorAnalytics", "label": "Status", "type": 1, "query": "BehaviorAnalytics\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Feature", "style": "secondary", "bladeOpenContext": { "bladeName": "EntitySearchBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Entity Behavior (UEBA) Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Microsoft Entra ID Protection Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#microsoft-entra-id-protection)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "AADIP", "label": "Status", "type": 1, "query": "SecurityAlert | where ProductName == \"Azure Active Directory Identity Protection\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "AzureActiveDirectoryIdentityProtection" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Azure Active Directory Identity Protection Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Threat Intelligence TAXII Connector](https://docs.microsoft.com/azure/sentinel/connect-threat-intelligence-taxii)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "TAXII", "label": "Status", "type": 1, "query": "ThreatIntelligenceIndicator | where SourceSystem !in (\"SecurityGraph\", \"Azure Sentinel\", \"Microsoft Sentinel\") \r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "ThreatIntelligenceTaxii" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Threat Intelligence TAXII Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Threat Intelligence Platform Connector](https://docs.microsoft.com/azure/sentinel/connect-threat-intelligence-tip)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "ThreatIntelligence", "label": "Status", "type": 1, "query": "ThreatIntelligenceIndicator | where SourceSystem in (\"SecurityGraph\", \"Azure Sentinel\", \"Microsoft Sentinel\") \r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "ThreatIntelligence" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Threat Intelligence Platform Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Microsoft Defender for IoT Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#microsoft-defender-for-iot)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "MD4IOT", "label": "Status", "type": 1, "query": "SecurityAlert | where ProductName == \"Azure Security Center for IoT\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "IoT" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Microsoft Defender for IoT Connector", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "### [Microsoft Purview: Insider Risk Management Connector](https://docs.microsoft.com/azure/sentinel/data-connectors-reference#microsoft-purview-information-protection)" }, "customWidth": "33", "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "548cdd92-87c3-4e69-be08-52ecca0f76a8", "version": "KqlParameterItem/1.0", "name": "IRM", "label": "Status", "type": 1, "query": "SecurityAlert\r\n| where ProductName == \"Microsoft 365 Insider Risk Management\"\r\n| limit 1\r\n| summarize count()\r\n| extend Results = iff(count_ ==0, \"❌ Not Connected\", \"✅ Connected\")\r\n| project Results", "crossComponentResources": [ "{Workspace}" ], "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "d9b9144c-69bc-4eb2-a747-a9e0d206780b", "linkTarget": "OpenBlade", "linkLabel": "Enable Connector", "style": "secondary", "bladeOpenContext": { "bladeName": "DataConnectorBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "dataConnectorId", "source": "static", "value": "OfficeIRM" } ] } } ] }, "customWidth": "33", "name": "EL0" } ], "exportParameters": true }, "name": "Microsoft Purview: Insider Risk Management Connector", "styleSettings": { "showBorder": true } } ] }, "name": "group - 6" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "isDCVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Recommended Data Connectors" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Recommended Content](https://docs.microsoft.com/azure/sentinel/sentinel-solutions-catalog)\r\n---\r\n\r\nThe following content packages provide utility for regulated industries use cases." }, "name": "NS Guide" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "b9a6293e-1c7b-4ec2-ad2a-d72b5ee01722", "cellValue": "https://docs.microsoft.com/azure/sentinel/sentinel-solutions", "linkTarget": "Url", "linkLabel": "About Microsoft Sentinel Content & Solutions", "style": "link" }, { "id": "1bad541e-219a-4277-9510-876b0e8cad51", "cellValue": "https://docs.microsoft.com/azure/sentinel/sentinel-solutions-catalog", "linkTarget": "Url", "linkLabel": "Content Hub Catalog", "style": "link" } ] }, "name": "links - 29" } ] }, "customWidth": "40", "name": "group - 4" }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "list", "links": [ { "id": "76c7831e-386d-4289-8145-486f52cba8ec", "linkTarget": "OpenBlade", "linkLabel": "Content Hub >>", "style": "secondary", "bladeOpenContext": { "bladeName": "ContentHub.ReactView", "extensionName": "Microsoft_Azure_SentinelUS", "bladeParameters": [] } } ] }, "customWidth": "40", "name": "EL0" } ] }, "name": "group - 7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [NIST SP 800-53 Solution](https://docs.microsoft.com/security/zero-trust/integrate/sentinel-solution)\r\n\r\n---\r\nThis solution is designed to augment staffing through automation, machine learning, query/alerting generation, and visualizations. This workbook leverages Azure Policy, Azure Resource Graph, and Azure Log Analytics to align with NIST SP 800-53 control requirements. This offering telemetry from 25+ Microsoft Security products (1P/3P/Multi-Cloud/Hybrid/On-Premises). Each NIST SP 800-53 control includes a Control Card detailing an overview of requirements, primary/secondary controls, deep-links to referenced product pages/portals, recommendations, implementation guides, compliance cross-walks and tooling telemetry for building situational awareness of cloud workloads.
\r\n\r\n---\r\n
\r\n\r\n---\r\n
\r\n\r\n---\r\n
\r\n\r\n---\r\n
\r\n\r\n---\r\n
\r\n\r\n---\r\n
\r\n\r\n---" }, "name": "text - 0" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "1bad541e-219a-4277-9510-876b0e8cad51", "cellValue": "https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-azure-sentinel-threat-intelligence-workbook/ba-p/2858265", "linkTarget": "Url", "linkLabel": "Workbook Blog", "style": "link" }, { "id": "b9a6293e-1c7b-4ec2-ad2a-d72b5ee01722", "cellValue": "https://youtu.be/SjEG7iVVBbI", "linkTarget": "Url", "linkLabel": "Video Demo", "style": "link" }, { "id": "7e8ff8aa-f632-4a4d-90cf-a71da0dc6b31", "cellValue": "https://github.com/Azure/Azure-Sentinel/blob/master/Workbooks/ThreatIntelligence.json", "linkTarget": "Url", "linkLabel": "GitHub Repo", "style": "link" } ] }, "name": "links - 29" } ] }, "customWidth": "50", "name": "Zero Trust Solution - Copy - Copy - Copy" } ] }, "conditionalVisibility": { "parameterName": "isGCVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Recommended Content" } ], "fromTemplateId": "sentinel-ContinuousDiagnostics&Mitigation", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }