{
"version": "Notebook/1.0",
"items": [
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "46c56e28-782c-460a-92a2-2537d1f0a231",
"version": "KqlParameterItem/1.0",
"name": "DefaultSubscription_Internal",
"type": 1,
"isRequired": true,
"query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| take 1\r\n| project subscriptionId",
"crossComponentResources": [
"value::selected"
],
"isHiddenWhenLocked": true,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
{
"id": "589770ff-4a35-409b-890c-3ed910fa7750",
"version": "KqlParameterItem/1.0",
"name": "InternalWSs",
"type": 1,
"query": "SecurityIncident\r\n| take 1\r\n| parse IncidentUrl with * \"/workspaces/\" Workspace \"/\" *\r\n| project Workspace",
"isHiddenWhenLocked": true,
"timeContext": {
"durationMs": 259200000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "f5bac3e6-e933-4d14-9797-8e22510db74b",
"version": "KqlParameterItem/1.0",
"name": "Subscription",
"type": 6,
"isRequired": true,
"query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| distinct subscriptionId, location\r\n| summarize by value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\r\n| order by value asc\r\n",
"typeSettings": {
"additionalResourceOptions": [],
"showDefault": false
},
"timeContext": {
"durationMs": 86400000
},
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
{
"id": "2d857f74-6e2b-4c95-a8ef-23f9c8d69607",
"version": "KqlParameterItem/1.0",
"name": "Workspace",
"type": 5,
"isRequired": true,
"query": "resources | where type =~ 'Microsoft.operationsmanagement/solutions' | where name contains 'SecurityInsights' \r\n| parse name with \"SecurityInsights(\" label \")\" \r\n| project id = tostring(properties.workspaceResourceId), label, selected = iff(label =~ '{InternalWSs}', true, false)",
"crossComponentResources": [
"{Subscription}"
],
"typeSettings": {
"additionalResourceOptions": [],
"showDefault": false
},
"timeContext": {
"durationMs": 86400000
},
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
{
"id": "ab972580-f202-4006-ac44-eef045622963",
"version": "KqlParameterItem/1.0",
"name": "TimeRange",
"type": 4,
"typeSettings": {
"selectableValues": [
{
"durationMs": 300000
},
{
"durationMs": 900000
},
{
"durationMs": 1800000
},
{
"durationMs": 3600000
},
{
"durationMs": 14400000
},
{
"durationMs": 43200000
},
{
"durationMs": 86400000
},
{
"durationMs": 172800000
},
{
"durationMs": 259200000
},
{
"durationMs": 604800000
},
{
"durationMs": 1209600000
},
{
"durationMs": 2419200000
},
{
"durationMs": 2592000000
},
{
"durationMs": 5184000000
},
{
"durationMs": 7776000000
}
],
"allowCustom": true
},
"timeContext": {
"durationMs": 86400000
},
"value": {
"durationMs": 2592000000
}
},
{
"id": "61ddad88-c141-4879-809e-e71f2043c602",
"version": "KqlParameterItem/1.0",
"name": "Help",
"label": "Show Help",
"type": 10,
"isRequired": true,
"typeSettings": {
"additionalResourceOptions": []
},
"jsonData": "[{ \"value\": \"Yes\", \"label\": \"Yes\", \"selected\":true},\r\n {\"value\": \"No\", \"label\": \"No\" }]",
"timeContext": {
"durationMs": 86400000
}
},
{
"id": "84598098-3e5f-4958-9c95-f0bd70d3761e",
"version": "KqlParameterItem/1.0",
"name": "RestorationRaw",
"type": 1,
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourcegroups/{Workspace:resourcegroup}/providers/microsoft.operationalinsights/workspaces/{Workspace:name}/tables?api-version=2021-12-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value[?(@.properties.schema.tableType==\\\"RestoredLogs\\\")]\",\"columns\":[]}}]}",
"isHiddenWhenLocked": true,
"queryType": 12
},
{
"id": "2b28ba70-b337-485c-9d9f-2f4a085457d5",
"version": "KqlParameterItem/1.0",
"name": "Tab",
"type": 1,
"isRequired": true,
"isGlobal": true,
"isHiddenWhenLocked": true,
"value": "1"
},
{
"id": "4e1f23dc-b0fd-45aa-9161-1da60625341c",
"version": "KqlParameterItem/1.0",
"name": "BasicTables",
"type": 1,
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourcegroups/{Workspace:resourcegroup}/providers/microsoft.operationalinsights/workspaces/{Workspace:name}/tables?api-version=2021-12-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value[?(@.properties.plan==\\\"Basic\\\")]\",\"columns\":[{\"path\":\"name\",\"columnid\":\"Name\",\"columnType\":\"string\"}]}}]}",
"isHiddenWhenLocked": true,
"queryType": 12
},
{
"version": "KqlParameterItem/1.0",
"name": "Archive",
"type": 1,
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourcegroups/{Workspace:resourcegroup}/providers/microsoft.operationalinsights/workspaces/{Workspace:name}/tables?api-version=2021-12-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value[?(@.properties.archiveRetentionInDays>0)]\",\"columns\":[{\"path\":\"name\",\"columnid\":\"Name\",\"columnType\":\"string\"}]}}]}",
"isHiddenWhenLocked": true,
"queryType": 12,
"id": "6fd9e7b1-0fa5-429d-9b36-ddbb343ac94e"
},
{
"id": "93e870c5-9e0d-461b-8004-cfaa8ea35c11",
"version": "KqlParameterItem/1.0",
"name": "SearchJob",
"type": 1,
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourcegroups/{Workspace:resourcegroup}/providers/microsoft.operationalinsights/workspaces/{Workspace:name}/tables?api-version=2021-12-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value[?(@.properties.schema.tableType==\\\"SearchResults\\\")]\",\"columns\":[{\"path\":\"systemData.createdAt\",\"columnid\":\"CreatedAt\"}]}}]}",
"isHiddenWhenLocked": true,
"queryType": 12
},
{
"id": "54c2f7f2-eb22-43df-b553-463fac9bdc07",
"version": "KqlParameterItem/1.0",
"name": "WorkspaceID",
"type": 1,
"query": "resources | where type ==\"microsoft.operationalinsights/workspaces\"\r\n| where id has '{Workspace}'\r\n| extend WorkspaceID = trim(\" \",tostring(properties.customerId))\r\n| project WorkspaceID\r\n",
"crossComponentResources": [
"{Subscription}"
],
"isHiddenWhenLocked": true,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
{
"id": "c0a95ddc-0f7a-44f0-91c5-18ca268ace18",
"version": "KqlParameterItem/1.0",
"name": "DCRDataFlowsRaw",
"type": 1,
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription:escapejson}/providers/Microsoft.Insights/dataCollectionRules?api-version=2022-06-01\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$..value[?(@.properties.destinations.logAnalytics[0].workspaceId==\\\"{WorkspaceID}\\\" && @.transformKql != \\\"source\\\")]\",\"columns\":[{\"path\":\"properties.dataFlows\",\"columnid\":\"dataFlow\"},{\"path\":\"properties.destinations.logAnalytics.*.workspaceResourceId\",\"columnid\":\"workspaceResourceId\"}]}}]}",
"isHiddenWhenLocked": true,
"queryType": 12
},
{
"id": "e6a84ecf-4440-47f5-83db-57eef23b0077",
"version": "KqlParameterItem/1.0",
"name": "Restoration",
"type": 1,
"isHiddenWhenLocked": true,
"criteriaData": [
{
"criteriaContext": {
"leftOperand": "RestorationRaw",
"operator": "isNotNull",
"rightValType": "param",
"resultValType": "param",
"resultVal": "RestorationRaw"
}
},
{
"criteriaContext": {
"operator": "Default",
"resultValType": "static",
"resultVal": "[{\"provisioningState\":\"Failed\"}]"
}
}
]
},
{
"id": "30fa1e54-5f3b-4fb7-902f-334c4b8a1c09",
"version": "KqlParameterItem/1.0",
"name": "DCRDataFlows",
"type": 1,
"isHiddenWhenLocked": true,
"criteriaData": [
{
"criteriaContext": {
"leftOperand": "DCRDataFlowsRaw",
"operator": "isNotNull",
"rightValType": "param",
"resultValType": "param",
"resultVal": "DCRDataFlowsRaw"
}
},
{
"criteriaContext": {
"operator": "Default",
"resultValType": "static",
"resultVal": "[{\"provisioningState\":\"Failed\"}]"
}
}
]
},
{
"id": "626f41fd-371e-473e-9233-0f7ddf5ac2d0",
"version": "KqlParameterItem/1.0",
"name": "ActiveAnalytics",
"type": 1,
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourcegroups/{Workspace:resourcegroup}/providers/microsoft.operationalinsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/alertRules?api-version=2023-06-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"properties.enabled\",\"columnid\":\"Enabled\"}]}}]}",
"isHiddenWhenLocked": true,
"queryType": 12
},
{
"id": "bb00f446-984d-42ef-a12f-886281f2a85a",
"version": "KqlParameterItem/1.0",
"name": "WatchlistAPI",
"type": 1,
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourcegroups/{Workspace:resourcegroup}/providers/microsoft.operationalinsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/watchlists?api-version=2023-02-01\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"name\",\"columnid\":\"Name\"}]}}]}",
"isHiddenWhenLocked": true,
"queryType": 12
},
{
"id": "6c84c91a-886e-418e-961f-291a9701dc2f",
"version": "KqlParameterItem/1.0",
"name": "Pricing",
"type": 1,
"query": "resources\r\n| where type =~ 'microsoft.OperationsManagement/solutions' \r\n| where name has 'SecurityInsights'\r\n| extend Workspace = properties.workspaceResourceId\r\n| where Workspace has '{Workspace}' \r\n| project sku = tostring(properties.sku.name)\r\n",
"crossComponentResources": [
"{Subscription}"
],
"isHiddenWhenLocked": true,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
{
"id": "38dee7c2-20bc-4890-9e6c-49b99e9e0ebe",
"version": "KqlParameterItem/1.0",
"name": "SOCOptimizationDataValue",
"type": 1,
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourcegroups/{Workspace:resourcegroup}/providers/microsoft.operationalinsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/recommendations?api-version=2024-01-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value[?(@.properties.recommendationTypeId==\\\"Precision_DataValue\\\")]\",\"columns\":[{\"path\":\"properties\",\"columnid\":\"Properties\"}]}}]}",
"isHiddenWhenLocked": true,
"queryType": 12
},
{
"version": "KqlParameterItem/1.0",
"name": "SOCOptimizationCoverage",
"type": 1,
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourcegroups/{Workspace:resourcegroup}/providers/microsoft.operationalinsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/recommendations?api-version=2024-01-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value[?(@.properties.recommendationTypeId==\\\"Precision_Coverage\\\")]\",\"columns\":[{\"path\":\"properties.state\",\"columnid\":\"State\"}]}}]}",
"isHiddenWhenLocked": true,
"queryType": 12,
"id": "7b5b1b5c-44a1-4932-889c-2cec2f848357"
},
{
"id": "c3ec7c4b-0dd0-47e0-8d05-c606cec7d996",
"version": "KqlParameterItem/1.0",
"name": "SocOptimizationRecommendation",
"type": 1,
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourcegroups/{Workspace:resourcegroup}/providers/microsoft.operationalinsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/recommendations?api-version=2024-01-01-preview\",\"urlParams\":[{\"key\":\"\",\"value\":\"\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"properties.state\",\"columnid\":\"State\"}]}}]}",
"isHiddenWhenLocked": true,
"queryType": 12
}
],
"style": "above",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters"
},
{
"type": 1,
"content": {
"json": "### Introduction\r\n\r\nThis workbook aims to help you gain insights into your current Microsoft Sentinel environment, while also providing recommendations for optimizing costs, improving operational effectiveness, and offering a management overview. \r\n\r\nThese insights are categorized into three tabs, which are presented in this workbook: **Cost and Ingestion Optimization**, **Operational Optimization and Effectiveness**, and **Management and Acceleration**.\r\n\r\nThe workbook includes a Summary section that provides an overview of the insights using tiles to display useful high-level information. More detailed information related to the summary can be found in the Details section, which includes individual line items\r\n\r\n**Required data sources:**\r\n\r\nTo visualize data under the 'Operational Optimization and Effectiveness' and 'Management and Acceleration' tabs, it is necessary to have auditing and health monitoring data.
\r\nFollow the instructions on how to [Turn on auditing and health monitoring for Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/enable-monitoring).",
"style": "info"
},
"conditionalVisibility": {
"parameterName": "Help",
"comparison": "isEqualTo",
"value": "Yes"
},
"name": "tex-Intro"
},
{
"type": 1,
"content": {
"json": "### Summary ###\r\n---"
},
"name": "text - 8"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "tabs",
"links": [
{
"id": "bb7dde2e-9f5b-4e9f-a638-a14b3871ec9a",
"cellValue": "Tab",
"linkTarget": "parameter",
"linkLabel": "Cost and Ingestion Optimization",
"subTarget": "1",
"style": "link",
"tabWidth": "280px"
},
{
"id": "bd346354-81a3-4f88-a7dd-e45f47bccc66",
"cellValue": "Tab",
"linkTarget": "parameter",
"linkLabel": "Operational Optimization and Effectiveness",
"subTarget": "2",
"style": "link",
"tabWidth": "280px"
},
{
"id": "ea75b5e4-b987-48d9-82dc-b72abf9d4846",
"cellValue": "Tab",
"linkTarget": "parameter",
"linkLabel": "Management and Acceleration",
"subTarget": "3",
"style": "link",
"tabWidth": "280px"
},
{
"id": "96be9d03-ccde-4a54-9244-9fdb946f95bb",
"cellValue": "Tab",
"linkTarget": "parameter",
"linkLabel": "SOC Optimization",
"subTarget": "4",
"style": "link",
"tabWidth": "200px"
}
]
},
"name": "TabsSummary"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Usage \r\n| where IsBillable == true\r\n| summarize BillableDataGB = sum(Quantity)/ 1000 \r\n| extend Title = \"Total Billable Ingestion\"\r\n| extend Text2 = \"{TimeRange:label}\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "BillableDataGB",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "blue"
},
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
"secondaryContent": {
"columnMatch": "Text2"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query -Tile-Ingestion"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Usage \r\n| where IsBillable == true\r\n| make-series BillableDataGB = sum(Quantity)/ 1000 default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} \r\nstep {TimeRange:grain} \r\n| extend Title = \"Ingestion Trend\"\r\n| extend Text = \"{TimeRange:label}\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "BillableDataGB",
"formatter": 9,
"formatOptions": {
"min": 0,
"palette": "greenBlue"
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
"secondaryContent": {
"columnMatch": "Text"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query -Tile-IngestionTrend"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Usage\r\n| where TimeGenerated {TimeRange:query}\r\n| where IsBillable == 'true'\r\n| summarize BillableDataGB = sum(Quantity)/ 1000 by DataType\r\n| top 1 by BillableDataGB desc\r\n| extend Title = \"Top Ingestion Table\"\r\n| extend Text2 = \"{TimeRange:label}\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"sortBy": [],
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"subtitleContent": {
"columnMatch": "DataType",
"formatter": 1
},
"leftContent": {
"columnMatch": "BillableDataGB",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "purple"
},
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
"secondaryContent": {
"columnMatch": "Text2"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query -Tile-TopIngestionTable"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "union withsource = _TableName *\r\n| make-series Trend = count() on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by _TableName\r\n| extend (anomalies, score, baseline) = series_decompose_anomalies(Trend, 1.5, 7, 'linefit', 1, 'ctukey', 0.01)\r\n| where anomalies[-1] == 1 or anomalies[-1] == -1 \r\n| extend Score = score[-1]\r\n| where Score >= 3 or Score <= -3\r\n| count\r\n| extend Title = \"Ingestion Anomalies\"\r\n| extend Text1 = \"tables found\"\r\n| extend Text2 = \"{TimeRange:label}\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"subtitleContent": {
"columnMatch": "Text1"
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "blue"
}
},
"secondaryContent": {
"columnMatch": "Text2"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-Tile-Anomaly"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces' \r\n| where id has '{Workspace}'\r\n| extend sku = trim(' ', tostring(properties.sku.name))\r\n| extend Title = \"Workspace Pricing\"\r\n| project ['Workspace Sku']=sku, ['Workspace Commitment Tier']=properties.sku.capacityReservationLevel, Title\r\n| extend Text1 = \"Pricing Configured\"\r\n\r\n",
"size": 4,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources",
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Workspace Sku",
"formatter": 16,
"formatOptions": {
"showIcon": true
}
},
"rightContent": {
"columnMatch": "Workspace Commitment Tier",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "blue"
}
},
"secondaryContent": {
"columnMatch": "Text1",
"formatter": 1,
"formatOptions": {
"compositeBarSettings": {
"labelText": "",
"columnSettings": []
}
}
},
"showBorder": false
}
},
"customWidth": "25",
"conditionalVisibility": {
"parameterName": "Pricing",
"comparison": "isNotEqualTo",
"value": "Unified"
},
"name": "query-Tile-WorkspaceSku"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "resources\r\n| where type =~ 'microsoft.OperationsManagement/solutions' \r\n| where name has 'SecurityInsights'\r\n| extend Workspace = properties.workspaceResourceId\r\n| where Workspace has '{Workspace}' \r\n| extend SentinelSku = trim(' ', tostring(properties.sku.name))\r\n| extend Title = \"Sentinel Pricing\"\r\n| project ['Sentinel Sku']= SentinelSku, ['Sentinel Commitment Tier']=properties.sku.capacityReservationLevel, Title\r\n| extend Text1 = \"Pricing Configured\"\r\n\r\n\r\n",
"size": 4,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources",
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Sentinel Sku",
"formatter": 16,
"formatOptions": {
"showIcon": true
}
},
"rightContent": {
"columnMatch": "Sentinel Commitment Tier",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "blue"
}
},
"secondaryContent": {
"columnMatch": "Text1",
"formatter": 1
},
"showBorder": false
}
},
"customWidth": "25",
"conditionalVisibility": {
"parameterName": "Pricing",
"comparison": "isNotEqualTo",
"value": "Unified"
},
"name": "query-Tile-SentinelSku"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces' \r\n| where id has '{Workspace}'\r\n| extend sku = trim(' ', tostring(properties.sku.name))\r\n| extend Title = \"Unified Pricing\"\r\n| project ['Workspace Sku']=sku, ['Workspace Commitment Tier']=properties.sku.capacityReservationLevel, Title\r\n| extend Text1 = \"Configured\"\r\n\r\n\r\n",
"size": 4,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources",
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Workspace Sku",
"formatter": 16,
"formatOptions": {
"showIcon": true
}
},
"rightContent": {
"columnMatch": "Workspace Commitment Tier",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "blue"
}
},
"secondaryContent": {
"columnMatch": "Text1",
"formatter": 1
},
"showBorder": false
}
},
"customWidth": "25",
"conditionalVisibility": {
"parameterName": "Pricing",
"comparison": "isEqualTo",
"value": "Unified"
},
"name": "query-Tile-UnifiedSku"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Usage\r\n| where IsBillable == true\r\n| where DataType in (\"SigninLogs\", \r\n\"AuditLogs\", \r\n\"AADNonInteractiveUserSignInLogs\", \r\n\"AADServicePrincipalSignInLogs\",\r\n\"AADManagedIdentitySignInLogs\",\r\n\"AADProvisioningLogs\",\r\n\"ADFSSignInLogs\",\r\n\"McasShadowItReporting\", \r\n\"InformationProtectionLogs_CL\", \r\n\"DeviceEvents\", \r\n\"DeviceFileEvents\", \r\n\"DeviceImageLoadEvents\", \r\n\"DeviceInfo\", \r\n\"DeviceLogonEvents\", \r\n\"DeviceNetworkEvents\", \r\n\"DeviceNetworkInfo\", \r\n\"DeviceProcessEvents\", \r\n\"DeviceRegistryEvents\",\r\n\"DeviceFileCertificateInfo\", \r\n\"EmailAttachmentInfo\", \r\n\"EmailEvents\", \r\n\"EmailPostDeliveryEvents\", \r\n\"EmailUrlInfo\",\r\n\"IdentityLogonEvents\",\r\n\"IdentityQueryEvents\",\r\n\"IdentityDirectoryEvents\",\r\n\"AlertEvidence\",\r\n\"CloudAppEvents\"\r\n) \r\n| summarize BillableDataGB = sum(Quantity) / 1000\r\n| extend Title = \"E5 Eligible Data\"\r\n| extend Text1 = \"total ingestion\"\r\n| extend Text2 = \"{TimeRange:label}\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"subtitleContent": {
"columnMatch": "Text1"
},
"leftContent": {
"columnMatch": "BillableDataGB",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "blue"
},
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal"
}
}
},
"secondaryContent": {
"columnMatch": "Text2"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-Tile-E5"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "resources\r\n| take 1\r\n| extend Basic = \"{BasicTables}\"\r\n| extend Basic = substring(Basic, 1,strlen(Basic)-2)\r\n| project BasicLogs_Table=split(Basic, ',')\r\n| mv-expand BasicLogs_Table\r\n| where isnotempty(BasicLogs_Table)\r\n| count\r\n| extend Title = \"Total Basic Logs Table\"\r\n| extend Text = \"in {Workspace:Label} workspace\"\r\n",
"size": 4,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "blue"
}
},
"secondaryContent": {
"columnMatch": "Text",
"formatter": 1
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query--Tile-TotalBasicLogs"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print tableRestoration = parse_json(dynamic({Restoration}))\r\n| extend tableRestoration = iif(tostring(tableRestoration) startswith \"[\",tableRestoration, todynamic(strcat(\"[\",tostring(tableRestoration), \"]\")))\r\n| mv-expand tableRestoration\r\n| evaluate bag_unpack(tableRestoration)\r\n| where provisioningState == \"Succeeded\"\r\n| summarize Total= count()\r\n| extend Title = \"Active Restored Table\"\r\n| extend Text = \"in {Workspace:name} workspace\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "Total",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "blue"
}
},
"secondaryContent": {
"columnMatch": "Text"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-Tile-RestorationTile"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "resources\r\n| take 1\r\n| extend SearchJob = \"{SearchJob}\"\r\n| extend SearchJob = substring(SearchJob, 1,strlen(SearchJob)-2)\r\n| project SearchJob_Table=split(SearchJob, ',')\r\n| mv-expand SearchJob_Table\r\n| where isnotempty(SearchJob_Table)\r\n| count\r\n| extend Title = \"Total Search Job Result\"\r\n| extend Text = \"in {Workspace:Label} workspace\"\r\n| extend Text2 = \"table(s)\"\r\n",
"size": 4,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "blue"
}
},
"rightContent": {
"columnMatch": "Text2"
},
"secondaryContent": {
"columnMatch": "Text",
"formatter": 1
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-Tile-TotalSearchJob"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print dataFlows = dynamic({DCRDataFlows})\r\n| mv-expand dataFlows\r\n| mv-expand dataFlows\r\n| where dataFlows has \"transformKql\"\r\n| parse kind=regex dataFlows.streams with * \"(Microsoft-(Table-)|Custom-(Table-))\" DataSource '\"'\r\n| summarize Count = dcount(DataSource)\r\n| extend Title = \"Table with Transformation\"\r\n| extend Text = \"in {Workspace:Label} workspace\"\r\n",
"size": 4,
"timeContext": {
"durationMs": 1800000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "blue"
}
},
"rightContent": {
"columnMatch": "Text2"
},
"secondaryContent": {
"columnMatch": "Text",
"formatter": 1
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-Tile-TotalTransformTable"
}
]
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "1"
},
"name": "group-CostSummary"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where CreatedTime {TimeRange:query}\r\n| where Severity == \"High\"\r\n| summarize Count = count_distinct(IncidentNumber)\r\n| extend Title = \"Incident Count by Severity\"\r\n| extend Text1 = \"{TimeRange:label}\"\r\n| extend Severity= \"High\"",
"size": 4,
"noDataMessage": "0",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Severity",
"formatter": 1
},
"subtitleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "red"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-tile-IncSeverityHigh"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where CreatedTime {TimeRange:query}\r\n| where Severity == \"Medium\"\r\n| summarize Count = count_distinct(IncidentNumber)\r\n| extend Title = \"Incident Count by Severity\"\r\n| extend Text1 = \"{TimeRange:label}\"\r\n| extend Severity= \"Medium\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Severity",
"formatter": 1
},
"subtitleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "orange"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-tile-IncSeverityMedium"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where CreatedTime {TimeRange:query}\r\n| where Severity == \"Low\"\r\n| summarize Count = count_distinct(IncidentNumber)\r\n| extend Title = \"Incident Count by Severity\"\r\n| extend Text1 = \"{TimeRange:label}\"\r\n| extend Severity= \"Low\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Severity",
"formatter": 1
},
"subtitleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "yellow"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-tile-IncSeverityLow"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where CreatedTime {TimeRange:query}\r\n| where Severity == \"Informational\"\r\n| summarize Count = count_distinct(IncidentNumber)\r\n| extend Title = \"Incident Count by Severity\"\r\n| extend Text1 = \"{TimeRange:label}\"\r\n| extend Severity= \"Informational\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Severity",
"formatter": 1
},
"subtitleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "gray"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-tile-IncSeverityInfo"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| summarize arg_max(LastModifiedTime,*) by IncidentNumber \r\n| extend TimeToAcknowledge = (FirstModifiedTime - CreatedTime)/1h\r\n| summarize Average = avg(TimeToAcknowledge)\r\n| extend Title = \"Avg Time to Ack.\"\r\n| extend Text1 = \"{TimeRange:label}\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"gridSettings": {
"formatters": [
{
"columnMatch": "Average",
"formatter": 0,
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "sum_TimeToAcknowledge",
"formatter": 0,
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "TimeToAcknowledge",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
}
]
},
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "Average",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "bluePurple"
},
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
},
"chartSettings": {
"ySettings": {
"numberFormatSettings": {
"unit": 25,
"options": {
"style": "decimal",
"useGrouping": true
}
}
}
},
"textSettings": {
"style": "bignumber"
}
},
"customWidth": "25",
"name": "query-Tile-ATTA"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber\r\n| where Status == 'Closed'\r\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\r\n| summarize Average = avg(TimeToClosure)\r\n| extend Title = \"Avg Time to Closure\"\r\n| extend Text1 = \"{TimeRange:label}\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"gridSettings": {
"formatters": [
{
"columnMatch": "Average",
"formatter": 0,
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal"
}
}
}
]
},
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "Average",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "bluePurple"
},
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-Tile-ATTC"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let TCount = (SecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentName\r\n| summarize TCount = count());\r\nlet WCount = (SecurityIncident\r\n| where LastModifiedTime != CreatedTime\r\n| where ModifiedBy has 'playbook'\r\n| summarize arg_max(TimeGenerated, *) by IncidentName\r\n| summarize WCount = count());\r\nlet Percent = (WIncident:double, Total:double) {\r\n print WOCount = (Total-WIncident)\r\n | extend Percentage = (WOCount/Total) * 100\r\n | project Percentage\r\n};\r\nPercent(toscalar(WCount),toscalar(TCount))\r\n| extend Title1 = \"Percent of Incidents\"\r\n| extend Title2 = \"without Automation\"\r\n| extend Text1 = \"{TimeRange:label}\"\r\n",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"gridSettings": {
"formatters": [
{
"columnMatch": "Percentage",
"formatter": 0,
"numberFormat": {
"unit": 1,
"options": {
"style": "decimal"
}
}
}
]
},
"tileSettings": {
"titleContent": {
"columnMatch": "Title1"
},
"subtitleContent": {
"columnMatch": "Title2",
"formatter": 1
},
"leftContent": {
"columnMatch": "Percentage",
"formatter": 12,
"formatOptions": {
"min": 0,
"max": 100,
"palette": "coldHot"
},
"numberFormat": {
"unit": 1,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
},
"textSettings": {
"style": "bignumber"
}
},
"customWidth": "25",
"name": "query-Tile-PercentIncWithoutAutomation"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber\r\n| where ModifiedBy has 'automation'\r\n| where Status == 'Closed'\r\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\r\n| summarize Average = avg(TimeToClosure)\r\n| extend Title = \"MTTR with Automation\"\r\n| extend Text1 = \"{TimeRange:label}\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "Average",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "bluePurple"
},
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
},
"textSettings": {
"style": "bignumber"
}
},
"customWidth": "25",
"name": "query-Tile-MTTRWithAutomation"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber\r\n| where ModifiedBy !has 'automation'\r\n| where Status == 'Closed'\r\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\r\n| summarize Average = avg(TimeToClosure)\r\n| extend Title = \"MTTR w/o Automation\"\r\n| extend Text1 = \"{TimeRange:label}\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "Average",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "bluePurple"
},
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
},
"textSettings": {
"style": "bignumber"
}
},
"customWidth": "25",
"name": "query-Tile-MTTRWithoutAutomation"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber\r\n| where Tasks != '[]'\r\n| where Status == 'Closed'\r\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\r\n| summarize Average = avg(TimeToClosure)\r\n| extend title = \"MTTR with Tasks\"\r\n| extend Text1 = \"{TimeRange:label}\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "title"
},
"leftContent": {
"columnMatch": "Average",
"formatter": 12,
"formatOptions": {
"palette": "bluePurple"
},
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
},
"textSettings": {
"style": "bignumber"
}
},
"customWidth": "25",
"name": "query-Tile-MTTRTasks"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SentinelHealth\r\n| where OperationName has 'analytics rule'\r\n| where Status == 'Failure'\r\n| summarize Count = count()\r\n| extend Title = \"Total Failed Analytics\"\r\n| extend Text1 = \"{TimeRange:label}\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "coldHot"
}
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
},
"textSettings": {
"style": "bignumber"
}
},
"customWidth": "25",
"name": "query-Tile-FailedAnalytics"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_SentinelAudit()\r\n| where SentinelResourceType ==\"Analytic Rule\"\r\n| summarize Count = count() \r\n| extend Title = \"Changes Made to Rules\"\r\n| extend Text1 = \"{TimeRange:label}\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "bluePurple"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"secondaryContent": {
"columnMatch": "Text1",
"formatter": 1
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-tile-RuleChanges"
}
]
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "2"
},
"name": "group-OperationalSummary"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces' \r\n| where id has \"{Workspace}\"\r\n| project retentionDays = trim(' ', tostring(properties.retentionInDays)) \r\n| extend Title = \"Workspace Retention\" \r\n| extend Text1 = \"configured for {Workspace:Label}\"\r\n| extend Text2 = \"days\"\r\n \r\n",
"size": 4,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources",
"crossComponentResources": [
"{Subscription}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 21,
"formatOptions": {
"palette": "blue"
}
},
"leftContent": {
"columnMatch": "retentionDays",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "magenta"
}
},
"rightContent": {
"columnMatch": "Text2",
"formatter": 1
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-Tile-Retention"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "resources\r\n| take 1\r\n| extend Archive = \"{Archive}\"\r\n| extend Archive = substring(Archive, 1,strlen(Archive)-2)\r\n| project Archive_Table=split(Archive, ',')\r\n| mv-expand Archive_Table\r\n| where isnotempty(Archive_Table)\r\n| count\r\n| extend Title = \"Tables with Archive\"\r\n| extend Text = \"in {Workspace:Label} workspace\"\r\n| extend Text2 = \"\"\r\n",
"size": 4,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "magenta"
}
},
"rightContent": {
"columnMatch": "Text2",
"formatter": 1
},
"secondaryContent": {
"columnMatch": "Text",
"formatter": 1
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query--Tile-TotalArchive"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_SentinelHealth() \r\n| where SentinelResourceType == \"Automation rule\"\r\n| distinct SentinelResourceName\r\n|summarize Count = count()\r\n| extend Title = \"Active Automation Rules\"\r\n| extend Text1 = \"{TimeRange:label}\"\r\n|extend Text2=\"found in SentinelHealth\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"subtitleContent": {
"columnMatch": "Text2"
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "magenta"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-Tile-UniqueAutomationRule"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_SentinelHealth() \r\n| where OperationName == \"Automation rule run\"\r\n|where Status == \"Failure\"\r\n|summarize Count = count()\r\n| extend Title = \"Failed Automation Rules\"\r\n| extend Text1 = \"{TimeRange:label}\"\r\n|extend Text2=\"runs\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "coldHot"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"rightContent": {
"columnMatch": "Text2"
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-Tile-AutomationHealth"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_SentinelHealth() \r\n| where SentinelResourceType == \"Playbook\"\r\n| distinct SentinelResourceName\r\n|summarize Count = count()\r\n| extend Title = \"Active Playbooks\"\r\n| extend Text1 = \"{TimeRange:label}\"\r\n|extend Text2=\"found in SentinelHealth\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"subtitleContent": {
"columnMatch": "Text2"
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "magenta"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-Tile-UniquePlaybook"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_SentinelHealth() \r\n| where SentinelResourceType == \"Playbook\"\r\n|where Status == \"Failure\"\r\n|summarize Count = count()\r\n| extend Title = \"Failed Playbook Runs\"\r\n| extend Text1 = \"{TimeRange:label}\"\r\n",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "coldHot"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-Tile-PlaybookHealth"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('/workspaces/{Workspace:name}')\r\n| summarize count()\r\n | extend Title = \"Active Workbooks\"\r\n | extend Text2 = \"in {Workspace:Label} workspace\"",
"size": 4,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources",
"crossComponentResources": [
"{Subscription}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "count_",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "magenta"
}
},
"secondaryContent": {
"columnMatch": "Text2"
},
"showBorder": false
},
"textSettings": {
"style": "bignumber"
}
},
"customWidth": "25",
"name": "query-Tile-Workbook"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicators\r\n|summarize Count = count()\r\n| extend Title = \"TI Indicators Ingested\"\r\n| extend Text1 = \"{TimeRange:label}\"\r\n",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "magenta"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-Tile-TI"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print Watchlist = \"{WatchlistAPI}\"\r\n| extend Watchlist = substring(Watchlist, 1,strlen(Watchlist)-2)\r\n| project Watchlist_Table=split(Watchlist, ',')\r\n| mv-expand Watchlist_Table\r\n| where isnotempty(Watchlist_Table)\r\n| extend Watchlist_Table = trim(\" \",tostring(Watchlist_Table))\r\n| count\r\n| extend Title = \"Total Watchlists\"\r\n| extend Text1 = \"in {Workspace:Label} workspace\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "magenta"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-Tile-Watchlist"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print ActiveAnalytics = \"{ActiveAnalytics}\"\r\n| extend ActiveAnalytics = substring(ActiveAnalytics, 1,strlen(ActiveAnalytics)-2)\r\n| project ActiveAnalytics_Table=split(ActiveAnalytics, ',')\r\n| mv-expand ActiveAnalytics_Table\r\n| extend ActiveAnalytics_Table = trim(\" \",tostring(ActiveAnalytics_Table))\r\n| where ActiveAnalytics_Table == \"true\"\r\n| count\r\n| extend Title = \"Enabled Analytics Rules\"\r\n| extend Text1 = \"in {Workspace:Label} workspace\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"sortBy": [],
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "magenta"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-Tile-UniqueAutomationRule"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_SentinelHealth() \r\n| where OperationName == \"Scheduled analytics rule run\"\r\n|where Status == \"Failure\"\r\n|summarize Count = count()\r\n| extend Title = \"Failed Analytics Rules\"\r\n| extend Text1 = \"{TimeRange:label}\"\r\n|extend Text2=\"runs\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "coldHot"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"rightContent": {
"columnMatch": "Text2"
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-Tile-AnalyticRules Health"
}
]
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "3"
},
"name": "group-ManagementSummary"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": " Optimizations status",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print SOCRecommendation = dynamic(\"{SocOptimizationRecommendation}\")\r\n| extend SOCRecommendation = substring(SOCRecommendation, 1,strlen(SOCRecommendation)-2)\r\n| project SOCRecommendation_Table=split(SOCRecommendation, ',')\r\n| mv-expand SOCRecommendation_Table\r\n| extend SOCRecommendation_Table = trim(\" \" ,tostring(SOCRecommendation_Table))\r\n| where SOCRecommendation_Table == \"Active\"\r\n| count\r\n| extend Title = \"Active\"\r\n| extend Text1 = \"in {Workspace:Label} workspace\"\r\n| extend Text2 = \"\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"sortBy": [],
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "turquoise"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"rightContent": {
"columnMatch": "Text2"
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-Tile-ActiveSOCRecommendation"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print SOCRecommendation = dynamic(\"{SocOptimizationRecommendation}\")\r\n| extend SOCRecommendation = substring(SOCRecommendation, 1,strlen(SOCRecommendation)-2)\r\n| project SOCRecommendation_Table=split(SOCRecommendation, ',')\r\n| mv-expand SOCRecommendation_Table\r\n| extend SOCRecommendation_Table = trim(\" \" ,tostring(SOCRecommendation_Table))\r\n| where SOCRecommendation_Table == \"InProgress\"\r\n| count\r\n| extend Title = \"In Progress\"\r\n| extend Text1 = \"in {Workspace:Label} workspace\"\r\n| extend Text2 = \"\"\r\n",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"sortBy": [],
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "blue"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"rightContent": {
"columnMatch": "Text2"
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-Tile-InProgressSOCRecommendation"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print SOCRecommendation = dynamic(\"{SocOptimizationRecommendation}\")\r\n| extend SOCRecommendation = substring(SOCRecommendation, 1,strlen(SOCRecommendation)-2)\r\n| project SOCRecommendation_Table=split(SOCRecommendation, ',')\r\n| mv-expand SOCRecommendation_Table\r\n| extend SOCRecommendation_Table = trim(\" \" ,tostring(SOCRecommendation_Table))\r\n| where SOCRecommendation_Table == \"Dismissed\"\r\n| count\r\n| extend Title = \"Dismissed\"\r\n| extend Text1 = \"in {Workspace:Label} workspace\"\r\n| extend Text2 = \"\"\r\n",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"sortBy": [],
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "orange"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"rightContent": {
"columnMatch": "Text2"
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-Tile-DismissedSOCRecommendation"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print SOCRecommendation = dynamic(\"{SocOptimizationRecommendation}\")\r\n| extend SOCRecommendation = substring(SOCRecommendation, 1,strlen(SOCRecommendation)-2)\r\n| project SOCRecommendation_Table=split(SOCRecommendation, ',')\r\n| mv-expand SOCRecommendation_Table\r\n| extend SOCRecommendation_Table = trim(\" \" ,tostring(SOCRecommendation_Table))\r\n| where SOCRecommendation_Table == \"CompletedByUser\"\r\n| count\r\n| extend Title = \"Completed By User\"\r\n| extend Text1 = \"in {Workspace:Label} workspace\"\r\n| extend Text2 = \"\"\r\n",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"sortBy": [],
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "green"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"rightContent": {
"columnMatch": "Text2"
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-Tile-CompletedUserSOCRecommendation"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print SOCRecommendation = dynamic(\"{SocOptimizationRecommendation}\")\r\n| extend SOCRecommendation = substring(SOCRecommendation, 1,strlen(SOCRecommendation)-2)\r\n| project SOCRecommendation_Table=split(SOCRecommendation, ',')\r\n| mv-expand SOCRecommendation_Table\r\n| extend SOCRecommendation_Table = trim(\" \" ,tostring(SOCRecommendation_Table))\r\n| where SOCRecommendation_Table == \"CompletedBySystem\"\r\n| count\r\n| extend Title = \"Completed By System\"\r\n| extend Text1 = \"in {Workspace:Label} workspace\"\r\n| extend Text2 = \"\"\r\n",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"sortBy": [],
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "green"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"rightContent": {
"columnMatch": "Text2"
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-Tile-CompletedSystemSOCRecommendation"
}
]
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "4"
},
"name": "group-SOCOptimization"
},
{
"type": 1,
"content": {
"json": "
\r\n
\r\n### Details ###\r\n---"
},
"name": "text - 14"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "tabs",
"links": [
{
"id": "8025096c-bf6a-43ec-b790-6b8a451bf157",
"cellValue": "Tab",
"linkTarget": "parameter",
"linkLabel": "Cost and Ingestion Optimization",
"subTarget": "1",
"style": "link",
"tabWidth": "350px"
},
{
"id": "385a41e7-2df8-4fb0-984c-d282ec64cd06",
"cellValue": "Tab",
"linkTarget": "parameter",
"linkLabel": "Operational Optimization and Effectiveness",
"subTarget": "2",
"style": "link",
"tabWidth": "350px"
},
{
"id": "15d09a1a-b237-4528-99a3-0d4d33e67831",
"cellValue": "Tab",
"linkTarget": "parameter",
"linkLabel": "Management and Acceleration",
"subTarget": "3",
"style": "link",
"tabWidth": "350px"
},
{
"id": "99640196-f676-4a79-9550-7c0754a35c9b",
"cellValue": "Tab",
"linkTarget": "parameter",
"linkLabel": "SOC Optimization",
"subTarget": "4",
"style": "link"
}
]
},
"conditionalVisibility": {
"parameterName": "test",
"comparison": "isEqualTo",
"value": "1"
},
"name": "Tabs"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Top Ingestions",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "42e4fb97-a449-447f-b481-b65d49c73616",
"version": "KqlParameterItem/1.0",
"name": "Price",
"label": "Ingestion price",
"type": 1,
"description": "Enter your ingestion price per GB (PAYG or Commitment Tier). You can also refer to Azure Pricing Calculator.",
"timeContext": {
"durationMs": 86400000
},
"value": ""
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "param-IngestionPrice"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Usage \r\n| where IsBillable == true\r\n| summarize BillableDataGB = sum(Quantity)/ 1000 \r\n| extend Title = \"Total Billable Ingestion\"\r\n| extend Text2 = \"{TimeRange:label}\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "BillableDataGB",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "blue"
},
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
"secondaryContent": {
"columnMatch": "Text2"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query -Tile-Ingestion"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Usage \r\n| where IsBillable == true\r\n| summarize BillableDataGB = sum(Quantity)/ 1000 by bin(TimeGenerated,1d)\r\n| summarize ['GBs/day'] =round(avg(BillableDataGB),2)\r\n| extend Title = \"Avg. billable ingestion\"\r\n| extend Text1 = \"per day\"\r\n| extend Text2 = \"{TimeRange:label}\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "GBs/day",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "blue"
},
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
"rightContent": {
"columnMatch": "Text1"
},
"secondaryContent": {
"columnMatch": "Text2"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query -Tile-Ingestion-Avg"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Usage\r\n| where IsBillable == true\r\n| summarize size = sum(Quantity)/1000 by IsBillable\r\n| project ['Estimated cost'] = size*{Price}",
"size": 4,
"title": "Total Billable cost, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {},
"rightContent": {
"columnMatch": "Estimated cost",
"formatter": 12,
"formatOptions": {
"palette": "greenRed"
},
"numberFormat": {
"unit": 0,
"options": {
"currency": "USD",
"style": "currency",
"maximumFractionDigits": 2
}
}
},
"showBorder": false
}
},
"conditionalVisibility": {
"parameterName": "Price",
"comparison": "isNotEqualTo"
},
"name": "queryIngestionPrice"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Usage \r\n| where IsBillable == true\r\n| make-series BillableData = sum(Quantity)/ 1000 default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} \r\nstep {TimeRange:grain} \r\n\r\n\r\n",
"size": 0,
"title": "Total Billable data, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "areachart",
"chartSettings": {
"ySettings": {
"numberFormatSettings": {
"unit": 39,
"options": {
"style": "decimal",
"useGrouping": true,
"maximumFractionDigits": 2
}
}
}
}
},
"name": "queryTotalIngestion"
},
{
"type": 1,
"content": {
"json": "#### Select a data type from the Top Billable Tables below for analysis",
"style": "upsell"
},
"name": "text - 11"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let Total =(\r\nUsage \r\n| where IsBillable == true\r\n| summarize TotalSize = sum(Quantity));\r\nUsage \r\n| where StartTime {TimeRange:value} \r\n| where IsBillable == 'true' \r\n| make-series IngestionTrend = sum(Quantity) default =0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DataType\r\n| extend Percentage = round(100.0 * array_sum(IngestionTrend) / toscalar(Total),2)\r\n| project DataType, ['Table Size'] = array_sum(IngestionTrend), Percentage, IngestionTrend \r\n| order by ['Table Size'] desc\r\n\r\n",
"size": 0,
"title": "Top billable Tables, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"exportFieldName": "DataType",
"exportParameterName": "TopIngestionDataType",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "Table Size",
"formatter": 3,
"formatOptions": {
"palette": "greenRed"
},
"numberFormat": {
"unit": 38,
"options": {
"style": "decimal",
"maximumSignificantDigits": 2
}
}
},
{
"columnMatch": "IngestionTrend",
"formatter": 9,
"formatOptions": {
"min": 0,
"palette": "blue"
}
},
{
"columnMatch": "Percentage",
"formatter": 8,
"formatOptions": {
"min": 0,
"palette": "lightBlue"
},
"numberFormat": {
"unit": 1,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "IsBillable",
"formatter": 5
}
],
"rowLimit": 10000,
"filter": true
}
},
"name": "queryTopBillableTable"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"crossComponentResources": [
"{Workspace}"
],
"parameters": [
{
"id": "d33c75f0-bb4b-4560-a407-b27f10e7df55",
"version": "KqlParameterItem/1.0",
"name": "TopIngestionColumns",
"type": 1,
"query": "{TopIngestionDataType} \r\n| take 1000\r\n| evaluate narrow()\r\n| where isnotempty(Value)\r\n| project Column\r\n//| summarize ColumnList=make_set(iif(ColumnType == 'dynamic',strcat('tostring(',ColumnName,')'), ColumnName))\r\n| summarize ColumnList=make_set(Column)\r\n| extend ColumnName = tostring(strcat_array(ColumnList, \", \"))\r\n| project-away ColumnList",
"crossComponentResources": [
"{Workspace}"
],
"isHiddenWhenLocked": true,
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "48939b18-bf0e-4840-b772-9744e5b683c6",
"version": "KqlParameterItem/1.0",
"name": "TopIngestionColumnQuery",
"type": 1,
"query": "{TopIngestionDataType} \r\n| take 1000\r\n| evaluate narrow()\r\n| where isnotempty(Value)\r\n| project Column= strcat(\"sum(estimate_data_size(tostring(\", Column, \")))\")\r\n//| summarize ColumnList=make_set(iif(ColumnType == 'dynamic',strcat('tostring(',ColumnName,')'), ColumnName))\r\n| summarize ColumnList=make_set(Column)\r\n| extend ColumnName = tostring(strcat_array( ColumnList, \", \"))\r\n| project-away ColumnList",
"crossComponentResources": [
"{Workspace}"
],
"isHiddenWhenLocked": true,
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"conditionalVisibility": {
"parameterName": "test123",
"comparison": "isNotEqualTo"
},
"name": "param-TopIngestionColumns"
},
{
"type": 1,
"content": {
"json": "### _Data analysis for '{TopIngestionDataType}' table:_"
},
"conditionalVisibility": {
"parameterName": "TopIngestionDataType",
"comparison": "isNotEqualTo"
},
"name": "text-DataAnalysis"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{TopIngestionDataType}\r\n| project {TopIngestionColumns}\r\n| evaluate autocluster(0.5)\r\n| project-away TimeGenerated\r\n| evaluate narrow()\r\n| where isnotempty(Value)\r\n| where Value !='##(null)'\r\n| evaluate pivot(Column, any(Value), Row)\r\n| project-away Row\r\n| extend Percent = round(todouble(Percent),2)\r\n| project-reorder SegmentId, Count, Percent\r\n| order by SegmentId asc",
"size": 0,
"title": "Common patterns of discrete attributes in the data",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "Count",
"formatter": 8,
"formatOptions": {
"min": 0,
"palette": "magenta",
"compositeBarSettings": {
"labelText": "",
"columnSettings": []
}
}
},
{
"columnMatch": "Percent",
"formatter": 8,
"formatOptions": {
"min": 0,
"max": 100,
"palette": "blue"
},
"numberFormat": {
"unit": 1,
"options": {
"style": "decimal",
"useGrouping": false,
"minimumFractionDigits": 2,
"maximumSignificantDigits": 2
}
}
}
],
"filter": true
}
},
"conditionalVisibility": {
"parameterName": "TopIngestionDataType",
"comparison": "isNotEqualTo"
},
"name": "query-TopIngestionPatterns",
"styleSettings": {
"showBorder": true
}
},
{
"type": 1,
"content": {
"json": "### _Column analysis for '{TopIngestionDataType}' table:_"
},
"conditionalVisibility": {
"parameterName": "TopIngestionDataType",
"comparison": "isNotEqualTo"
},
"name": "text-ColumnAnalysis"
},
{
"type": 1,
"content": {
"json": "#### Select a column name from below for analysis",
"style": "upsell"
},
"customWidth": "35",
"conditionalVisibilities": [
{
"parameterName": "TopIngestionSelectedColumn",
"comparison": "isEqualTo"
},
{
"parameterName": "TopIngestionDataType",
"comparison": "isNotEqualTo"
}
],
"name": "text -TopIngestionColumnsbreakdown"
},
{
"type": 1,
"content": {
"json": ""
},
"customWidth": "65",
"conditionalVisibilities": [
{
"parameterName": "TopIngestionSelectedColumn",
"comparison": "isEqualTo"
},
{
"parameterName": "TopIngestionDataType",
"comparison": "isNotEqualTo"
}
],
"name": "text - 5"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{TopIngestionDataType}\r\n| summarize {TopIngestionColumnQuery}\r\n| evaluate narrow()\r\n| project-away Row\r\n| extend Value=toreal(Value) \r\n| order by Value desc\r\n| extend Column = trim_start('sum_string_size_',Column)\r\n| project-rename ['TotalSize(Bytes)']=Value \r\n",
"size": 2,
"title": "{TopIngestionDataType} table's columns by size",
"timeContextFromParameter": "TimeRange",
"exportFieldName": "Column",
"exportParameterName": "TopIngestionSelectedColumn",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "Column",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "22ch"
}
},
{
"columnMatch": "TotalSize(Bytes)",
"formatter": 8,
"formatOptions": {
"min": 0,
"palette": "bluePurple",
"customColumnWidthSetting": "19ch"
},
"numberFormat": {
"unit": 36,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "ColumnName",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "25ch"
}
}
],
"rowLimit": 500,
"filter": true
},
"sortBy": []
},
"customWidth": "35",
"conditionalVisibility": {
"parameterName": "TopIngestionDataType",
"comparison": "isNotEqualTo"
},
"name": "query-TopIngestionColumns"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": ""
},
"name": "text - 2"
},
{
"type": 1,
"content": {
"json": "#### Selected column : '{TopIngestionSelectedColumn}'",
"style": "info"
},
"conditionalVisibility": {
"parameterName": "TopIngestionSelectedColumn",
"comparison": "isNotEqualTo"
},
"name": "text - 3"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let Total = (\r\n{TopIngestionDataType}\r\n| count\r\n);\r\n{TopIngestionDataType}\r\n| project {TopIngestionSelectedColumn}\r\n| summarize Count = count() by {TopIngestionSelectedColumn}\r\n| extend Percentage = round(100.0 * Count/toscalar(Total),2)\r\n| project-away Count\r\n//| order by Count desc\r\n",
"size": 0,
"title": "Top values for '{TopIngestionSelectedColumn}' column",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "piechart",
"gridSettings": {
"formatters": [
{
"columnMatch": "Percent",
"formatter": 4,
"formatOptions": {
"min": 0,
"max": 100,
"palette": "bluePurple"
},
"numberFormat": {
"unit": 1,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
}
]
},
"chartSettings": {
"ySettings": {
"numberFormatSettings": {
"unit": 1,
"options": {
"style": "decimal",
"useGrouping": true
}
}
}
}
},
"conditionalVisibility": {
"parameterName": "TopIngestionSelectedColumn",
"comparison": "isNotEqualTo"
},
"name": "query-TopIngestionSelectedColumnChart"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{TopIngestionDataType}\r\n| project {TopIngestionSelectedColumn}\r\n//| evaluate basket()\r\n//| project-away SegmentId\r\n//| order by Count desc\r\n| summarize Count = count() by {TopIngestionSelectedColumn}\r\n| order by Count desc\r\n| take 30\r\n",
"size": 0,
"title": "Top 30 values for '{TopIngestionSelectedColumn}' column",
"timeContextFromParameter": "TimeRange",
"exportFieldName": "{TopIngestionSelectedColumn}",
"exportParameterName": "TopIngestionSelectedColumnValue",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"formatters": [
{
"columnMatch": "Percent",
"formatter": 4,
"formatOptions": {
"min": 0,
"max": 100,
"palette": "bluePurple"
},
"numberFormat": {
"unit": 1,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
}
]
}
},
"conditionalVisibility": {
"parameterName": "TopIngestionSelectedColumn",
"comparison": "isNotEqualTo"
},
"name": "query-TopIngestionSelectedColumn"
},
{
"type": 1,
"content": {
"json": "#### Consider filtering the row or column values? ####\r\n\r\n** Review Filtering Options: **\r\n\r\nOnce you have analysed the data and decided to filter the column values. Below are some guidance for your reference:\r\n\r\n1. Verify if your table *{TopIngestionDataType}* is supported by [data transformation](https://learn.microsoft.com/azure/sentinel/data-transformation) by checking [Tables that support transformations](https://learn.microsoft.com/azure/azure-monitor/logs/tables-feature-support).\r\n\r\n2. If the table *{TopIngestionDataType}* is supported by transformation, you can leverage ingestion-time transformation for [filtering](https://learn.microsoft.com/azure/sentinel/data-transformation#filtering) using [Data Collection Rules (DCRs)](https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview?tabs=portal).\r\n\r\n3. Determine the [DCR support](https://learn.microsoft.com/azure/sentinel/data-transformation#dcr-support-for-microsoft-sentinel-data-connectors) type based on the collection method of the table.
Refer to sample [Workspace transform](https://learn.microsoft.com/azure/azure-monitor/logs/tutorial-workspace-transformations-portal) and [Standard transform](https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#how-transformations-work). More samples can be found [here](https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#create-a-transformation).\r\n\r\n4. Transformations are defined in a DCR using [KQL statement](https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations-structure) under the field named **transformKql**.
Refer to a [sample DCR](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/data-collection-transformations#single-destination) with transformation, you will find **transformKql** under **dataFlows** section.
\r\n\r\n\t#### Below are some sample transformKQL statements:\r\n\t_Note: The samples are for your reference only. Please update and test the transformKQL accordingly_.\r\n\r\n\t
\r\n\t**1. Filter out records with specific value**:\r\n\t\r\n\t_source | where {TopIngestionSelectedColumn} !has 'Your filter value'_\r\n\r\n\t
\r\n\t**2. Filter out the entire column**:\r\n\t\r\n\t_source | project-away {TopIngestionSelectedColumn}_\r\n\r\n\r\n
\r\n\r\n_**Note:** [Standard columns](https://learn.microsoft.com/azure/azure-monitor/logs/log-standard-columns) are [excluded](https://learn.microsoft.com/azure/azure-monitor/logs/cost-logs#excluded-columns) from the billable data volume calculation._",
"style": "upsell"
},
"conditionalVisibility": {
"parameterName": "TopIngestionSelectedColumn",
"comparison": "isNotEqualTo"
},
"name": "text-TopIngestionSelectedColumnConsiderFilter"
}
]
},
"customWidth": "65",
"name": "group-TopIngestionColumnAnalysis"
},
{
"type": 1,
"content": {
"json": ""
},
"name": "text - 19"
},
{
"type": 1,
"content": {
"json": "---"
},
"conditionalVisibility": {
"parameterName": "TopIngestionDataType",
"comparison": "isNotEqualTo"
},
"name": "text - 20"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "find withsource=TableName1 in (Event, SecurityEvent, Syslog, CommonSecurityLog) where TimeGenerated {TimeRange:Query} project _BilledSize, _IsBillable, Computer, _ResourceId, EventID, Activity, SyslogMessage, RenderedDescription\r\n| where _IsBillable == true\r\n| summarize ['Table Size'] = sum(_BilledSize) by TableName=TableName1 , EventID, Activity, RenderedDescription, SyslogMessage\r\n| extend EventDescription = iif(isempty(Activity),RenderedDescription,Activity)\r\n| extend EventDescription = iif(isempty(EventDescription),SyslogMessage,EventDescription)\r\n| project-away RenderedDescription, SyslogMessage, Activity\r\n| top 10 by ['Table Size'] desc",
"size": 0,
"title": "Top 10 EventIds, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Table Size",
"formatter": 4,
"formatOptions": {
"palette": "greenRed"
},
"numberFormat": {
"unit": 36,
"options": {
"style": "decimal",
"maximumSignificantDigits": 2
}
}
}
]
}
},
"name": "queryTopEventID"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "find where TimeGenerated {TimeRange:Query} project _BilledSize, _IsBillable, Computer, _ResourceId\r\n| where _isBillable=true and isnotempty(Computer) \r\n| summarize billedData = sumif(_BilledSize, _IsBillable=~true) by Computer, _ResourceId\r\n| where Computer != \"Deprecated field: see http://aka.ms/LA-Usage\"\r\n| order by billedData desc\r\n\r\n",
"size": 0,
"title": "Top billable data by Computer",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "billedData",
"formatter": 4,
"formatOptions": {
"palette": "greenRed"
},
"numberFormat": {
"unit": 36,
"options": {
"style": "decimal",
"maximumSignificantDigits": 2
}
}
}
],
"rowLimit": 10000,
"filter": true
}
},
"name": "queryTopComputer"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "CommonSecurityLog\r\n| where TimeGenerated {TimeRange:Query}\r\n| where _IsBillable == true\r\n| summarize BillableDataGB = sum(_BilledSize) /1024/1024 ,EventCount=count() by DeviceVendor, DeviceProduct\r\n| order by BillableDataGB desc",
"size": 0,
"title": "CommonSecurityLog (CEF) Ingestion by Product",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "BillableDataGB",
"formatter": 4,
"formatOptions": {
"palette": "greenRed",
"customColumnWidthSetting": "24ch"
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "EventCount",
"formatter": 8,
"formatOptions": {
"palette": "purpleBlue"
}
},
{
"columnMatch": "billedData",
"formatter": 4,
"formatOptions": {
"palette": "greenRed"
},
"numberFormat": {
"unit": 2,
"options": {
"style": "decimal",
"maximumSignificantDigits": 2
}
}
}
]
}
},
"name": "queryTopCEFProduct"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "CommonSecurityLog\r\n| where TimeGenerated {TimeRange:Query}\r\n| where _IsBillable == true\r\n| summarize BillableDataGB = sum(_BilledSize) /1024/1024 ,EventCount=count() by SourceIP,DeviceExternalID,DeviceName, Computer,DeviceVendor, DeviceProduct\r\n| order by BillableDataGB desc",
"size": 0,
"title": "CommonSecurityLog (CEF) Ingestion by SourceIP, DeviceExternalID, DeviceName",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "BillableDataGB",
"formatter": 4,
"formatOptions": {
"palette": "greenRed",
"customColumnWidthSetting": "24ch"
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "EventCount",
"formatter": 8,
"formatOptions": {
"palette": "purpleBlue"
}
},
{
"columnMatch": "billedData",
"formatter": 4,
"formatOptions": {
"palette": "greenRed"
},
"numberFormat": {
"unit": 2,
"options": {
"style": "decimal",
"maximumSignificantDigits": 2
}
}
}
]
}
},
"name": "queryTopCEFDevice"
}
]
},
"customWidth": "70",
"name": "groupTopIngestionBy"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Top Ingestions ###\r\n\r\n**Identify and prioritize your top billable tables:**\r\n\r\nTo optimize costs, it's important to identify and prioritize the tables that are generating the most billing. Review **Top billable Tables** and when applicable, consider reducing low value data by implementing filtering with [data transformation](https://learn.microsoft.com/azure/sentinel/data-transformation).\r\n\r\n
\r\n\r\n**Review and tune your top security event IDs:**\r\n\r\nSome security event IDs may be more important than others, and processing all events can lead to unnecessary costs. To optimize costs, review **Top 10 EventIds** and consider tuning your event id collections by filtering noisy or unwanted event ids. Event filtering can be done at source with [Data Collector Rule](https://learn.microsoft.com/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent?tabs=portal#filter-events-using-xpath-queries) when using Azure Monitor Agent or at ingestion time with [data transformation](https://learn.microsoft.com/azure/sentinel/data-transformation).\r\n\r\n
\r\n\r\n**Monitor and manage ingestion by computer:** \r\n\r\nIt's important to monitor and manage the ingestion rate by computer. Review **Top billable data by Computer** and identify computers that are generating excessive data. Once you identify these computers, you can review the data sources and consider tuning the [Data Collector Rule](https://learn.microsoft.com/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent?tabs=portal#filter-events-using-xpath-queries).",
"style": "upsell"
},
"name": "text-TopIngestionBy"
}
]
},
"customWidth": "30",
"name": "groupInsights-TopIngestionBy"
}
]
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "1"
},
"name": "group-Cost",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Ingestion Anomalies",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "union withsource = _TableName *\r\n| make-series Trend = count() on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by _TableName\r\n| extend (anomalies, score, baseline) = series_decompose_anomalies(Trend, 1.5, 7, 'linefit', 1, 'ctukey', 0.01)\r\n| project-away anomalies, score\r\n| render timechart \r\n",
"size": 0,
"title": "Total ingestion event count (Trend) vs baseline, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "billedData",
"formatter": 4,
"formatOptions": {
"palette": "greenRed"
},
"numberFormat": {
"unit": 2,
"options": {
"style": "decimal",
"maximumSignificantDigits": 2
}
}
}
]
}
},
"name": "queryTotalCountBaseline"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "union withsource = _TableName *\r\n| make-series Trend = count() on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by _TableName\r\n| extend (anomalies, score, baseline) = series_decompose_anomalies(Trend, 1.5, 7, 'linefit', 1, 'ctukey', 0.01)\r\n| where anomalies[-1] == 1 or anomalies[-1] == -1 \r\n| extend Score = score[-1]\r\n| where Score >= 3 or Score <= -3\r\n| project [\"Table Name\"] = _TableName, expectedCounts=baseline[-1], actualCount=Trend[-1], Score = score[-1],Trend, Baseline = baseline",
"size": 0,
"title": "Tables with ingestion anomalies, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "expectedCounts",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "24ch"
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "actualCount",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "22ch"
}
},
{
"columnMatch": "Score",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "12ch"
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "Trend",
"formatter": 10,
"formatOptions": {
"min": 0,
"palette": "blue"
}
},
{
"columnMatch": "Baseline",
"formatter": 21,
"formatOptions": {
"min": 0,
"palette": "turquoise"
}
}
],
"rowLimit": 10000,
"filter": true,
"labelSettings": [
{
"columnId": "expectedCounts",
"label": "Expected event count"
},
{
"columnId": "actualCount",
"label": "Actual event count"
}
]
}
},
"name": "queryTableAnomaly"
},
{
"type": 1,
"content": {
"json": ""
},
"name": "text - 4"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "6fb5414f-5c01-4d28-b3ea-f9abeb9f85c6",
"version": "KqlParameterItem/1.0",
"name": "LastDataReceived",
"label": "Last ingestion more than ",
"type": 4,
"typeSettings": {
"selectableValues": [
{
"durationMs": 900000
},
{
"durationMs": 1800000
},
{
"durationMs": 3600000
},
{
"durationMs": 14400000
},
{
"durationMs": 43200000
},
{
"durationMs": 86400000
},
{
"durationMs": 172800000
},
{
"durationMs": 259200000
},
{
"durationMs": 604800000
},
{
"durationMs": 1209600000
},
{
"durationMs": 2419200000
},
{
"durationMs": 2592000000
}
],
"allowCustom": true
},
"timeContext": {
"durationMs": 86400000
},
"value": {
"durationMs": 3600000
}
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters-Anomaly"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "union withsource = _TableName *\r\n| where TimeGenerated {TimeRange:query}\r\n| summarize last_log = datetime_diff(\"second\",now(), max(TimeGenerated)) by _TableName\r\n| where last_log > {LastDataReceived:seconds}\r\n| project ['Table Name'] = _TableName, ['Last Record Received'] = last_log \r\n| join kind= leftouter (\r\nUsage\r\n| where StartTime {TimeRange:value}\r\n| make-series Trend = sum(Quantity) default =0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DataType\r\n) on $left.['Table Name'] == $right.DataType\r\n| project-away TimeGenerated, DataType\r\n| order by ['Last Record Received'] desc\r\n ",
"size": 0,
"title": "Last data received > {LastDataReceived:label}, by table",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Last Record Received",
"formatter": 8,
"formatOptions": {
"palette": "orangeRed"
},
"numberFormat": {
"unit": 24,
"options": {
"style": "decimal",
"maximumSignificantDigits": 2
}
}
},
{
"columnMatch": "Trend",
"formatter": 9,
"formatOptions": {
"min": 0,
"palette": "blue"
}
}
],
"rowLimit": 10000,
"filter": true
}
},
"name": "queryTableLastReceived"
}
]
},
"customWidth": "70",
"name": "groupTableIngestionAnomaly"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Ingestion Anomalies ###\r\n\r\nMicrosoft Sentinel is a cloud-native security information and event management (SIEM) system that provides intelligent security analytics and threat intelligence across enterprise networks. One of the key features of Sentinel is its ability to ingest and analyze large volumes of security data from various sources in near real-time. However, when there is a sudden spike or anomaly in the data ingestion rate, it can indicate potential issues or security threats that need to be investigated.
\r\n**Here are some recommendations or steps for Microsoft Sentinel users to check and review ingestion spikes or anomalies:**\r\n\r\n\r\n* **Review the data ingestion metrics** on the left to identify sudden spikes or anomalies in data ingestion rates.\r\n\r\n* **If tables with ingestion anomalies were found, review the insights** provided such as 'expected event count', 'actual event count', anomaly score and trend.
\r\n - **Expected event count:** - The predicted value of the series, according to the decomposition.
\r\n - **Actual event count:** - Actual count of event being ingested.
\r\n - **Anomaly score:** - The function takes an expression with a dynamic numerical array as input, and generates a dynamic numeric array of the same length. Each value of the array indicates a score of a possible anomaly, using [\"Tukey's test\"](https://en.wikipedia.org/wiki/Outlier#Tukey%27s_fences). A value greater than 1.5 in the same element of the input indicates a rise or decline anomaly. A value less than -1.5, indicates a decline anomaly.\r\n\r\n\r\n* **Investigate the ingestion anomaly root cause** by checking if there are any issues with the data source that could be causing the ingestion anomaly and take appropriate remedial action accordingly.\r\nFor example, if the data source is Syslog or CommonSecurityLog - check if it is the security device that generating more logs than usual or if there are any configuration issues.\r\n\r\n* **Monitor ingestion metrics regularly** to identify any significant changes or spikes. Refer to [Monitor the health of your data connectors](https://learn.microsoft.com/azure/sentinel/monitor-data-connector-health) documentation to understand all the options for connector health monitoring and leverage [health monitoring workbook](https://learn.microsoft.com/azure/sentinel/monitor-data-connector-health#use-the-health-monitoring-workbook) more additional metrics related to ingestion anomalies.\r\n\r\n* **Configure Sentinel to send alerts and notifications** when there are sudden spikes or anomalies in data ingestion rates. This can help you identify potential security incidents or system issues and take timely action. Refer to [Ingestion Cost Spike detection Playbook](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/ingestion-cost-spike-detection-playbook/ba-p/2591301) on how to configure it.\r\n\r\n\r\n",
"style": "upsell"
},
"name": "text-TopIngestionBy"
}
]
},
"customWidth": "30",
"name": "groupInsights-TableIngestionAnomaly"
}
]
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "1"
},
"name": "group-IngestionAnomaly",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Pricing Sku & Commitment Tier",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"crossComponentResources": [
"{Subscription}"
],
"parameters": [
{
"id": "1edcceca-ed16-4d1b-bb39-fc95dddcedf1",
"version": "KqlParameterItem/1.0",
"name": "SentinelCT",
"type": 1,
"query": "resources\r\n| where type =~ 'microsoft.OperationsManagement/solutions' \r\n| where name has 'SecurityInsights'\r\n| extend Workspace = properties.workspaceResourceId\r\n| where Workspace has '{Workspace}' \r\n| project capacityReservationLevel = properties.sku.capacityReservationLevel\r\n\r\n",
"crossComponentResources": [
"{Subscription}"
],
"isHiddenWhenLocked": true,
"timeContext": {
"durationMs": 86400000
},
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
{
"id": "36b97669-119a-4dae-9ab9-22e0e1d285c9",
"version": "KqlParameterItem/1.0",
"name": "LawCT",
"type": 1,
"query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces' \r\n| where id has '{Workspace}'\r\n| project capacityReservationLevel = properties.sku.capacityReservationLevel",
"crossComponentResources": [
"{Subscription}"
],
"isHiddenWhenLocked": true,
"timeContext": {
"durationMs": 86400000
},
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
{
"id": "b12e7143-eb93-4d59-931c-6a07620e8f42",
"version": "KqlParameterItem/1.0",
"name": "GBperday",
"type": 1,
"query": "Usage\r\n| where IsBillable == True\r\n| summarize TotalGBytes =sum(Quantity)/1000 by bin(TimeGenerated, 1d) \r\n| summarize GBperday =round(avg(TotalGBytes),2) ",
"crossComponentResources": [
"{Workspace}"
],
"isHiddenWhenLocked": true,
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
}
],
"style": "above",
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
"name": "parameters - CommitmentTier"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces' \r\n| where id has '{Workspace}'\r\n| extend state = trim(' ', tostring(properties.provisioningState))\r\n\t\t,sku = trim(' ', tostring(properties.sku.name))\r\n ,skuUpdate = trim(' ', tostring(properties.sku.lastSkuUpdate))\r\n\t\t,dailyquotaGB = trim(' ', tostring(properties.workspaceCapping.dailyQuotaGb))\r\n| extend dailyquotaGB = iif(dailyquotaGB !=-1.0, dailyquotaGB,\"Not set\")\r\n| extend skuUpdate = iif(strlen(skuUpdate) > 0, skuUpdate,\"Unknown\")\r\n| project ['Workspace Name']=id, ['Resource Group']=resourceGroup, location, ['Workspace Sku']=sku, ['Workspace Commitment Tier']=properties.sku.capacityReservationLevel\r\n\r\n",
"size": 4,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources",
"crossComponentResources": [
"{Subscription}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "billedData",
"formatter": 4,
"formatOptions": {
"palette": "greenRed"
},
"numberFormat": {
"unit": 2,
"options": {
"style": "decimal",
"maximumSignificantDigits": 2
}
}
}
]
}
},
"conditionalVisibility": {
"parameterName": "A",
"comparison": "isNotEqualTo"
},
"name": "queryPricingSummaryTemp1"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Usage\r\n| where IsBillable == True\r\n| summarize TotalGBytes =sum(Quantity)/1000 by bin(TimeGenerated, 1d) , Workspace= ResourceUri\r\n| summarize ['Avg GB/day'] =round(avg(TotalGBytes),2) by Workspace",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "billedData",
"formatter": 4,
"formatOptions": {
"palette": "greenRed"
},
"numberFormat": {
"unit": 2,
"options": {
"style": "decimal",
"maximumSignificantDigits": 2
}
}
}
]
}
},
"customWidth": "70",
"conditionalVisibility": {
"parameterName": "A",
"comparison": "isNotEqualTo"
},
"name": "queryPricingSummaryTemp2"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "resources\r\n| where type =~ 'microsoft.OperationsManagement/solutions' \r\n| where name has 'SecurityInsights'\r\n| extend Workspace = properties.workspaceResourceId\r\n| where Workspace has '{Workspace}' \r\n| extend SentinelSku = trim(' ', tostring(properties.sku.name))\r\n| project Workspace, ['Sentinel Sku']= SentinelSku, ['Sentinel Commitment Tier']=properties.sku.capacityReservationLevel\r\n\r\n\r\n\r\n",
"size": 4,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources",
"crossComponentResources": [
"{Subscription}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "billedData",
"formatter": 4,
"formatOptions": {
"palette": "greenRed"
},
"numberFormat": {
"unit": 2,
"options": {
"style": "decimal",
"maximumSignificantDigits": 2
}
}
}
]
}
},
"customWidth": "70",
"conditionalVisibility": {
"parameterName": "A",
"comparison": "isNotEqualTo"
},
"name": "queryPricingSummaryTemp3"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"7fb9c036-c835-4972-af53-3f08676ed103\",\"mergeType\":\"innerunique\",\"leftTable\":\"queryPricingSummaryTemp1\",\"rightTable\":\"queryPricingSummaryTemp2\",\"leftColumn\":\"Workspace Name\",\"rightColumn\":\"Workspace\"},{\"id\":\"29a2fcd1-bffd-45ee-9b5e-146025b1707b\",\"mergeType\":\"innerunique\",\"leftTable\":\"queryPricingSummaryTemp1\",\"rightTable\":\"queryPricingSummaryTemp3\",\"leftColumn\":\"Workspace Name\",\"rightColumn\":\"Workspace\"}],\"projectRename\":[{\"originalName\":\"[queryPricingSummaryTemp1].Workspace Name\",\"mergedName\":\"Workspace\",\"fromId\":\"7fb9c036-c835-4972-af53-3f08676ed103\"},{\"originalName\":\"[queryPricingSummaryTemp2].Avg GB/day\",\"mergedName\":\"Avg GB/day\",\"fromId\":\"7fb9c036-c835-4972-af53-3f08676ed103\"},{\"originalName\":\"[queryPricingSummaryTemp1].Workspace Sku\",\"mergedName\":\"Workspace Sku\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryPricingSummaryTemp1].Workspace Commitment Tier\",\"mergedName\":\"Workspace Commitment Tier\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryPricingSummaryTemp3].Sentinel Sku\",\"mergedName\":\"Sentinel Sku\",\"fromId\":\"29a2fcd1-bffd-45ee-9b5e-146025b1707b\"},{\"originalName\":\"[queryPricingSummaryTemp3].Sentinel Commitment Tier\",\"mergedName\":\"Sentinel Commitment Tier\",\"fromId\":\"29a2fcd1-bffd-45ee-9b5e-146025b1707b\"},{\"originalName\":\"[queryPricingSummaryTemp2].Workspace\"},{\"originalName\":\"[queryPricingSummaryTemp3].Workspace\"},{\"originalName\":\"[queryPricingSummaryTemp1].Resource Group\"},{\"originalName\":\"[queryPricingSummaryTemp1].location\"}]}",
"size": 4,
"title": "Workspace Sku Summary",
"queryType": 7,
"gridSettings": {
"formatters": [
{
"columnMatch": "Workspace",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "20ch"
}
},
{
"columnMatch": "Avg GB/day",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "16ch"
}
},
{
"columnMatch": "Workspace Sku",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "18ch"
}
},
{
"columnMatch": "Workspace Commitment Tier",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "30ch"
}
},
{
"columnMatch": "Sentinel Sku",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "16ch"
}
},
{
"columnMatch": "Sentinel Commitment Tier",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "28ch"
}
}
]
}
},
"customWidth": "99",
"conditionalVisibility": {
"parameterName": "Pricing",
"comparison": "isNotEqualTo",
"value": "Unified"
},
"showPin": false,
"name": "queryPricingSummary"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"7fb9c036-c835-4972-af53-3f08676ed103\",\"mergeType\":\"innerunique\",\"leftTable\":\"queryPricingSummaryTemp1\",\"rightTable\":\"queryPricingSummaryTemp2\",\"leftColumn\":\"Workspace Name\",\"rightColumn\":\"Workspace\"},{\"id\":\"29a2fcd1-bffd-45ee-9b5e-146025b1707b\",\"mergeType\":\"innerunique\",\"leftTable\":\"queryPricingSummaryTemp1\",\"rightTable\":\"queryPricingSummaryTemp3\",\"leftColumn\":\"Workspace Name\",\"rightColumn\":\"Workspace\"}],\"projectRename\":[{\"originalName\":\"[queryPricingSummaryTemp1].Workspace Name\",\"mergedName\":\"Workspace\",\"fromId\":\"7fb9c036-c835-4972-af53-3f08676ed103\"},{\"originalName\":\"[queryPricingSummaryTemp2].Avg GB/day\",\"mergedName\":\"Avg GB/day\",\"fromId\":\"7fb9c036-c835-4972-af53-3f08676ed103\"},{\"originalName\":\"[queryPricingSummaryTemp3].Sentinel Sku\",\"mergedName\":\"Sentinel Pricing\",\"fromId\":\"29a2fcd1-bffd-45ee-9b5e-146025b1707b\"},{\"originalName\":\"[queryPricingSummaryTemp1].Workspace Sku\",\"mergedName\":\"Sku\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryPricingSummaryTemp1].Workspace Commitment Tier\",\"mergedName\":\"Commitment Tier\",\"fromId\":\"unknown\"},{\"originalName\":\"[queryPricingSummaryTemp2].Workspace\"},{\"originalName\":\"[queryPricingSummaryTemp3].Workspace\"},{\"originalName\":\"[queryPricingSummaryTemp1].Resource Group\"},{\"originalName\":\"[queryPricingSummaryTemp1].location\"},{\"originalName\":\"[queryPricingSummaryTemp3].Sentinel Commitment Tier\"}]}",
"size": 4,
"title": "Workspace Sku Summary",
"queryType": 7,
"gridSettings": {
"formatters": [
{
"columnMatch": "Workspace",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "20ch"
}
},
{
"columnMatch": "Avg GB/day",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "16ch"
}
},
{
"columnMatch": "Workspace Sku",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "18ch"
}
},
{
"columnMatch": "Workspace Commitment Tier",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "30ch"
}
},
{
"columnMatch": "Sentinel Sku",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "16ch"
}
},
{
"columnMatch": "Sentinel Commitment Tier",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "28ch"
}
}
]
}
},
"customWidth": "99",
"conditionalVisibility": {
"parameterName": "Pricing",
"comparison": "isEqualTo",
"value": "Unified"
},
"showPin": false,
"name": "queryPricingSummary2"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "#### Commitment Tier Recommendations ####"
},
"name": "text-CT-Recommend"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "94024518-571f-4d5d-99c0-177fb43d6bce",
"version": "KqlParameterItem/1.0",
"name": "CTDateEvaluate",
"label": "Days to evaluate",
"type": 4,
"isRequired": true,
"typeSettings": {
"selectableValues": [
{
"durationMs": 604800000
},
{
"durationMs": 1209600000
},
{
"durationMs": 2419200000
},
{
"durationMs": 2592000000
},
{
"durationMs": 5184000000
},
{
"durationMs": 7776000000
}
],
"allowCustom": true
},
"timeContext": {
"durationMs": 86400000
},
"value": {
"durationMs": 2592000000
}
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters-CT-date"
},
{
"type": 1,
"content": {
"json": "**Note:** If you have Microsoft 365 E5, A5, F5, and G5 and Microsoft 365 E5, A5, F5, and G5 Security licenses in your environment, please specify the total number of seats.",
"style": "info"
},
"name": "text-E5Info"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "ddb3a017-1a51-48ae-a094-abb72153e62d",
"version": "KqlParameterItem/1.0",
"name": "TotalE5Seats",
"label": "Total seats (E5/A5/F5/G5)",
"type": 1,
"timeContext": {
"durationMs": 86400000
},
"value": ""
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters-E5"
},
{
"type": 1,
"content": {
"json": "##### Please update these parameters with the pay-as-you-go (per-GB) and commitment tier pricing details for your workspace region (by default, prices for East US region are populated). Refer to [Microsoft Sentinel pricing](https://azure.microsoft.com/pricing/details/microsoft-sentinel/) #####\r\n\r\nSteps:\r\n - Go to the [Microsoft Sentinel pricing](https://azure.microsoft.com/pricing/details/microsoft-sentinel/) page, select your Sentinel workspace region and choose your currency.
\r\n _**Note:** Prices reflect the total cost for the data analysed by Microsoft Sentinel, including data ingestion charges for Azure Monitor Log Analytics._\r\n - Populate the amount based on the 'Microsoft Sentinel Price' column in the workbook.\r\n - Save the workbook once the pricing parameters are updated.\r\n\r\n",
"style": "info"
},
"name": "text-CT-Pricing"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "f446fead-5fa5-455e-b629-ae218220fa09",
"version": "KqlParameterItem/1.0",
"name": "PAYGPrice",
"label": "Pay-As-You-Go: $",
"type": 1,
"isRequired": true,
"timeContext": {
"durationMs": 86400000
},
"value": "4.30"
},
{
"id": "c4aee476-e87c-4dbb-9d4b-624342bd6655",
"version": "KqlParameterItem/1.0",
"name": "CT100Pricing",
"label": "100 GB per day: $",
"type": 1,
"isRequired": true,
"timeContext": {
"durationMs": 86400000
},
"value": "296"
},
{
"id": "a8869026-d839-495b-a6d6-d204ef4d2651",
"version": "KqlParameterItem/1.0",
"name": "CT200Pricing",
"label": "200 GB per day: $",
"type": 1,
"isRequired": true,
"timeContext": {
"durationMs": 86400000
},
"value": "548"
},
{
"id": "95d55e73-8463-4f94-8b22-319308236a08",
"version": "KqlParameterItem/1.0",
"name": "CT300Pricing",
"label": "300 GB per day: $",
"type": 1,
"isRequired": true,
"timeContext": {
"durationMs": 86400000
},
"value": "800"
},
{
"id": "3d5094fa-8f69-4339-8ecc-d887d56dabc2",
"version": "KqlParameterItem/1.0",
"name": "CT400Pricing",
"label": "400 GB per day: $",
"type": 1,
"isRequired": true,
"timeContext": {
"durationMs": 86400000
},
"value": "1037.33"
},
{
"id": "050fd3bf-6859-428d-ad0b-55aa78ec7581",
"version": "KqlParameterItem/1.0",
"name": "CT500Pricing",
"label": "500 GB per day: $",
"type": 1,
"isRequired": true,
"timeContext": {
"durationMs": 86400000
},
"value": "1265"
},
{
"id": "a7b10afc-eef2-4f12-aa86-96dd1edd58aa",
"version": "KqlParameterItem/1.0",
"name": "CT1000Pricing",
"label": "1000 GB per day:$",
"type": 1,
"isRequired": true,
"timeContext": {
"durationMs": 86400000
},
"value": "2480"
},
{
"id": "d4ac71ab-d847-41a8-b4b3-a67984a9d0b0",
"version": "KqlParameterItem/1.0",
"name": "CT2000Pricing",
"label": "2000 GB per day:$",
"type": 1,
"isRequired": true,
"timeContext": {
"durationMs": 86400000
},
"value": "4800"
},
{
"id": "51876291-8bd1-4498-99b9-b8bb6498beca",
"version": "KqlParameterItem/1.0",
"name": "CT5000Pricing",
"label": "5000 GB per day:$",
"type": 1,
"isRequired": true,
"timeContext": {
"durationMs": 86400000
},
"value": "11550"
}
],
"style": "formHorizontal",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"customWidth": "20",
"name": "parameters-CT-Pricing"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let StartDate = {CTDateEvaluate:start};\r\nlet EndDate = {CTDateEvaluate:end};\r\nUsage \r\n| where TimeGenerated >= StartDate and TimeGenerated < EndDate\r\n| where IsBillable == true\r\n| summarize DataGB=sum(Quantity)/1000. by Day=bin(StartTime, 1d) \r\n| extend BillableGB = DataGB \r\n| extend PerGBDailyCost = BillableGB * real({PAYGPrice:value})\r\n| extend CommitmentTier100DailyCost = real({CT100Pricing:value}) + max_of(BillableGB - 100, 0.)* real({CT100Pricing:value})/100.\r\n| extend CommitmentTier200DailyCost = real({CT200Pricing:value}) + max_of(BillableGB - 200, 0.)* real({CT200Pricing:value})/200.\r\n| extend CommitmentTier300DailyCost = real({CT300Pricing:value}) + max_of(BillableGB - 300, 0.)* real({CT300Pricing:value})/300.\r\n| extend CommitmentTier400DailyCost = real({CT400Pricing:value}) + max_of(BillableGB - 400, 0.)* real({CT400Pricing:value})/400.\r\n| extend CommitmentTier500DailyCost = real({CT500Pricing:value}) + max_of(BillableGB - 500, 0.)* real({CT500Pricing:value})/500.\r\n| extend CommitmentTier1000DailyCost = real({CT1000Pricing:value}) + max_of(BillableGB - 1000, 0.)* real({CT1000Pricing:value})/1000.\r\n| extend CommitmentTier2000DailyCost = real({CT2000Pricing:value}) + max_of(BillableGB - 2000, 0.)* real({CT2000Pricing:value})/2000.\r\n| extend CommitmentTier5000DailyCost = real({CT5000Pricing:value}) + max_of(BillableGB - 5000, 0.)* real({CT5000Pricing:value})/5000.\r\n| extend MinCost = min_of(\r\n PerGBDailyCost,CommitmentTier100DailyCost,CommitmentTier200DailyCost,\r\n CommitmentTier300DailyCost, CommitmentTier400DailyCost, CommitmentTier500DailyCost, CommitmentTier1000DailyCost, CommitmentTier2000DailyCost, CommitmentTier5000DailyCost)\r\n| extend Recommendation = case(\r\n MinCost == PerGBDailyCost, \"Pay-as-you-go tier\",\r\n MinCost == CommitmentTier100DailyCost, \"Commitment tier (100 GB/day)\",\r\n MinCost == CommitmentTier200DailyCost, \"Commitment tier (200 GB/day)\",\r\n MinCost == CommitmentTier300DailyCost, \"Commitment tier (300 GB/day)\",\r\n MinCost == CommitmentTier400DailyCost, \"Commitment tier (400 GB/day)\",\r\n MinCost == CommitmentTier500DailyCost, \"Commitment tier (500 GB/day)\",\r\n MinCost == CommitmentTier1000DailyCost, \"Commitment tier (1000 GB/day)\",\r\n MinCost == CommitmentTier2000DailyCost, \"Commitment tier (2000 GB/day)\",\r\n MinCost == CommitmentTier5000DailyCost, \"Commitment tier (5000 GB/day)\",\r\n \"Error\"\r\n)\r\n| project Day, BillableGB, PerGBDailyCost,CommitmentTier100DailyCost, CommitmentTier200DailyCost, CommitmentTier300DailyCost, CommitmentTier400DailyCost, CommitmentTier500DailyCost, CommitmentTier1000DailyCost, CommitmentTier2000DailyCost, CommitmentTier5000DailyCost, Recommendation \r\n| sort by Day asc\r\n//| project Day, Recommendation // Comment this line to see details\r\n| sort by Day asc",
"size": 2,
"title": "Daily cost comparisons by Tier , from {CTDateEvaluate:label} data",
"timeContextFromParameter": "CTDateEvaluate",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Day",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "18ch"
},
"dateFormat": {
"formatName": "shortDatePattern"
}
},
{
"columnMatch": "BillableGB",
"formatter": 4,
"formatOptions": {
"min": 0,
"palette": "lightBlue"
},
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "PerGBDailyCost",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "20ch"
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "CommitmentTier100DailyCost",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "32ch"
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "CommitmentTier200DailyCost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "CommitmentTier300DailyCost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "CommitmentTier400DailyCost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "CommitmentTier500DailyCost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "CommitmentTier1000DailyCost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "CommitmentTier2000DailyCost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "CommitmentTier5000DailyCost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
}
]
}
},
"conditionalVisibility": {
"parameterName": "TotalE5Seats",
"comparison": "isEqualTo"
},
"name": "query-CT-DailyRecommendation"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let StartDate = {CTDateEvaluate:start};\r\nlet EndDate = {CTDateEvaluate:end};\r\nUsage \r\n| where TimeGenerated >= StartDate and TimeGenerated < EndDate\r\n| where IsBillable == true\r\n| summarize DataGB=sum(Quantity)/1000. by day=bin(StartTime, 1d) \r\n| extend billableGB = DataGB \r\n| extend PerGBDailyCost = billableGB * real({PAYGPrice:value})\r\n| extend CommitmentTier100DailyCost = real({CT100Pricing:value}) + max_of(billableGB - 100, 0.)* real({CT100Pricing:value})/100.\r\n| extend CommitmentTier200DailyCost = real({CT200Pricing:value}) + max_of(billableGB - 200, 0.)* real({CT200Pricing:value})/200.\r\n| extend CommitmentTier300DailyCost = real({CT300Pricing:value}) + max_of(billableGB - 300, 0.)* real({CT300Pricing:value})/300.\r\n| extend CommitmentTier400DailyCost = real({CT400Pricing:value}) + max_of(billableGB - 400, 0.)* real({CT400Pricing:value})/400.\r\n| extend CommitmentTier500DailyCost = real({CT500Pricing:value}) + max_of(billableGB - 500, 0.)* real({CT500Pricing:value})/500.\r\n| extend CommitmentTier1000DailyCost = real({CT1000Pricing:value}) + max_of(billableGB - 1000, 0.)* real({CT1000Pricing:value})/1000.\r\n| extend CommitmentTier2000DailyCost = real({CT2000Pricing:value}) + max_of(billableGB - 2000, 0.)* real({CT2000Pricing:value})/2000.\r\n| extend CommitmentTier5000DailyCost = real({CT5000Pricing:value}) + max_of(billableGB - 5000, 0.)* real({CT5000Pricing:value})/5000.\r\n| summarize TotalPAYGCost = round(sum(PerGBDailyCost),2), CommitmentTier100TotalCost=round(sum(CommitmentTier100DailyCost),2), CommitmentTier200TotalCost=round(sum(CommitmentTier200DailyCost),2), CommitmentTier300TotalCost=round(sum(CommitmentTier300DailyCost),2), CommitmentTier400TotalCost=round(sum(CommitmentTier400DailyCost),2), CommitmentTier500TotalCost=round(sum(CommitmentTier500DailyCost),2), CommitmentTier1000TotalCost=round(sum(CommitmentTier1000DailyCost),2), CommitmentTier2000TotalCost=round(sum(CommitmentTier2000DailyCost),2), CommitmentTier5000TotalCost=round(sum(CommitmentTier5000DailyCost),2)\r\n| extend MinCost = min_of(\r\n TotalPAYGCost,CommitmentTier100TotalCost,CommitmentTier200TotalCost,\r\n CommitmentTier300TotalCost, CommitmentTier400TotalCost, CommitmentTier500TotalCost, CommitmentTier1000TotalCost, CommitmentTier2000TotalCost, CommitmentTier5000TotalCost)\r\n| extend Recommendation = case(\r\n MinCost == TotalPAYGCost, \"Pay-as-you-go tier\",\r\n MinCost == CommitmentTier100TotalCost, \"Commitment tier (100 GB/day)\",\r\n MinCost == CommitmentTier200TotalCost, \"Commitment tier (200 GB/day)\",\r\n MinCost == CommitmentTier300TotalCost, \"Commitment tier (300 GB/day)\",\r\n MinCost == CommitmentTier400TotalCost, \"Commitment tier (400 GB/day)\",\r\n MinCost == CommitmentTier500TotalCost, \"Commitment tier (500 GB/day)\",\r\n MinCost == CommitmentTier1000TotalCost, \"Commitment tier (1000 GB/day)\",\r\n MinCost == CommitmentTier2000TotalCost, \"Commitment tier (2000 GB/day)\",\r\n MinCost == CommitmentTier5000TotalCost, \"Commitment tier (5000 GB/day)\",\r\n \"Error\"\r\n)\r\n| project Tier = pack_array(\"PAYG\",\"CommitmentTier_100\",\"CommitmentTier_200\",\"CommitmentTier_300\",\"CommitmentTier_400\",\"CommitmentTier_500\",\"CommitmentTier_1000\",\"CommitmentTier_2000\",\"CommitmentTier_5000\",\"Recommendation\") , TotalCost = pack_array(TotalPAYGCost,CommitmentTier100TotalCost,CommitmentTier200TotalCost,CommitmentTier300TotalCost,CommitmentTier400TotalCost,CommitmentTier500TotalCost,CommitmentTier1000TotalCost,CommitmentTier2000TotalCost,CommitmentTier5000TotalCost,Recommendation)\r\n| mvexpand Tier, TotalCost\r\n",
"size": 0,
"title": "Summary and Recommendation, from {CTDateEvaluate:label} data",
"timeContextFromParameter": "CTDateEvaluate",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Tier",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "Recommendation",
"representation": "yellow",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "day",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "22ch"
}
},
{
"columnMatch": "billableGB",
"formatter": 4,
"formatOptions": {
"min": -2,
"palette": "blueLight",
"customColumnWidthSetting": "110px"
},
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "PerGBDailyCost",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "20ch"
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "CommitmentTier100DailyCost",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "32ch"
}
}
]
}
},
"conditionalVisibility": {
"parameterName": "TotalE5Seats",
"comparison": "isEqualTo"
},
"name": "query-CT-DailyRecommendation-Summary"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let StartDate = {CTDateEvaluate:start};\r\nlet EndDate = {CTDateEvaluate:end};\r\nlet DailyMaxDiscountGB = ((5*toreal({TotalE5Seats}))/1000);\r\nlet E5 = (\r\nUsage\r\n| where TimeGenerated >= StartDate and TimeGenerated < EndDate\r\n| where IsBillable == true\r\n| where DataType in (\"SigninLogs\", \r\n\"AuditLogs\", \r\n\"AADNonInteractiveUserSignInLogs\", \r\n\"AADServicePrincipalSignInLogs\",\r\n\"AADManagedIdentitySignInLogs\",\r\n\"AADProvisioningLogs\",\r\n\"ADFSSignInLogs\",\r\n\"McasShadowItReporting\", \r\n\"InformationProtectionLogs_CL\", \r\n\"DeviceEvents\", \r\n\"DeviceFileEvents\", \r\n\"DeviceImageLoadEvents\", \r\n\"DeviceInfo\", \r\n\"DeviceLogonEvents\", \r\n\"DeviceNetworkEvents\", \r\n\"DeviceNetworkInfo\", \r\n\"DeviceProcessEvents\", \r\n\"DeviceRegistryEvents\",\r\n\"DeviceFileCertificateInfo\", \r\n\"EmailAttachmentInfo\", \r\n\"EmailEvents\", \r\n\"EmailPostDeliveryEvents\", \r\n\"EmailUrlInfo\",\r\n\"IdentityLogonEvents\",\r\n\"IdentityQueryEvents\",\r\n\"IdentityDirectoryEvents\",\r\n\"AlertEvidence\",\r\n\"CloudAppEvents\") \r\n| summarize DailyBillableGB = toreal(sum(Quantity))/ 1000 by Day=bin(TimeGenerated, 1d)\r\n| summarize E5UsageGB = sum(iif(toreal(DailyBillableGB)>toreal(DailyMaxDiscountGB),toreal(DailyMaxDiscountGB),DailyBillableGB)) by Day\r\n);\r\nUsage \r\n| where TimeGenerated >= StartDate and TimeGenerated < EndDate\r\n| where IsBillable == true\r\n| summarize DataGB=sum(Quantity)/1000. by Day=bin(StartTime, 1d) \r\n| extend TotalIngestionGB = DataGB \r\n| sort by Day asc\r\n| join E5 on Day\r\n| project-away Day1\r\n| extend BillableGB = toreal(TotalIngestionGB) - toreal(E5UsageGB)\r\n| extend PerGBDailyCost = BillableGB * real({PAYGPrice:value})\r\n| extend CommitmentTier100DailyCost = real({CT100Pricing:value}) + max_of( BillableGB - 100, 0.)* real({CT100Pricing:value})/100.\r\n| extend CommitmentTier200DailyCost = real({CT200Pricing:value}) + max_of( BillableGB - 200, 0.)* real({CT200Pricing:value})/200.\r\n| extend CommitmentTier300DailyCost = real({CT300Pricing:value}) + max_of( BillableGB - 300, 0.)* real({CT300Pricing:value})/300.\r\n| extend CommitmentTier400DailyCost = real({CT400Pricing:value}) + max_of( BillableGB - 400, 0.)* real({CT400Pricing:value})/400.\r\n| extend CommitmentTier500DailyCost = real({CT500Pricing:value}) + max_of( BillableGB - 500, 0.)* real({CT500Pricing:value})/500.\r\n| extend CommitmentTier1000DailyCost = real({CT1000Pricing:value}) + max_of( BillableGB - 1000, 0.)* real({CT1000Pricing:value})/1000.\r\n| extend CommitmentTier2000DailyCost = real({CT2000Pricing:value}) + max_of( BillableGB - 2000, 0.)* real({CT2000Pricing:value})/2000.\r\n| extend CommitmentTier5000DailyCost = real({CT5000Pricing:value}) + max_of( BillableGB - 5000, 0.)* real({CT5000Pricing:value})/5000.\r\n| extend MinCost = min_of(\r\n PerGBDailyCost,CommitmentTier100DailyCost,CommitmentTier200DailyCost,\r\n CommitmentTier300DailyCost, CommitmentTier400DailyCost, CommitmentTier500DailyCost, CommitmentTier1000DailyCost, CommitmentTier2000DailyCost, CommitmentTier5000DailyCost)\r\n| extend Recommendation = case(\r\n MinCost == PerGBDailyCost, \"Pay-as-you-go tier\",\r\n MinCost == CommitmentTier100DailyCost, \"Commitment tier (100 GB/day)\",\r\n MinCost == CommitmentTier200DailyCost, \"Commitment tier (200 GB/day)\",\r\n MinCost == CommitmentTier300DailyCost, \"Commitment tier (300 GB/day)\",\r\n MinCost == CommitmentTier400DailyCost, \"Commitment tier (400 GB/day)\",\r\n MinCost == CommitmentTier500DailyCost, \"Commitment tier (500 GB/day)\",\r\n MinCost == CommitmentTier1000DailyCost, \"Commitment tier (1000 GB/day)\",\r\n MinCost == CommitmentTier2000DailyCost, \"Commitment tier (2000 GB/day)\",\r\n MinCost == CommitmentTier5000DailyCost, \"Commitment tier (5000 GB/day)\",\r\n \"Error\"\r\n)\r\n| project Day, ['BillableGB (Total - E5)']= BillableGB,TotalIngestionGB,E5UsageGB, PerGBDailyCost,CommitmentTier100DailyCost, CommitmentTier200DailyCost, CommitmentTier300DailyCost, CommitmentTier400DailyCost, CommitmentTier500DailyCost, CommitmentTier1000DailyCost, CommitmentTier2000DailyCost, CommitmentTier5000DailyCost, Recommendation\r\n| sort by Day asc",
"size": 2,
"title": "Daily cost comparisons by Tier , from {CTDateEvaluate:label} data",
"timeContextFromParameter": "CTDateEvaluate",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Day",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "18ch"
},
"dateFormat": {
"formatName": "shortDatePattern"
}
},
{
"columnMatch": "BillableGB (Total - E5)",
"formatter": 4,
"formatOptions": {
"min": 0,
"palette": "blue",
"customColumnWidthSetting": "24ch"
},
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "TotalIngestionGB",
"formatter": 4,
"formatOptions": {
"min": 0,
"palette": "blue",
"customColumnWidthSetting": "20ch"
},
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "E5UsageGB",
"formatter": 4,
"formatOptions": {
"min": 0,
"palette": "turquoise",
"customColumnWidthSetting": "18ch"
},
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "PerGBDailyCost",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "20ch"
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "CommitmentTier100DailyCost",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "32ch"
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "CommitmentTier200DailyCost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "CommitmentTier300DailyCost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "CommitmentTier400DailyCost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "CommitmentTier500DailyCost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "CommitmentTier1000DailyCost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "CommitmentTier2000DailyCost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "CommitmentTier5000DailyCost",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
}
]
}
},
"conditionalVisibility": {
"parameterName": "TotalE5Seats",
"comparison": "isNotEqualTo"
},
"name": "query-CT-DailyRecommendationWithE5"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let StartDate = {CTDateEvaluate:start};\r\nlet EndDate = {CTDateEvaluate:end};\r\nlet DailyMaxDiscountGB = ((5*toreal({TotalE5Seats}))/1000);\r\nlet E5 = (\r\nUsage\r\n| where TimeGenerated >= StartDate and TimeGenerated < EndDate\r\n| where IsBillable == true\r\n| where DataType in (\"SigninLogs\", \r\n\"AuditLogs\", \r\n\"AADNonInteractiveUserSignInLogs\", \r\n\"AADServicePrincipalSignInLogs\",\r\n\"AADManagedIdentitySignInLogs\",\r\n\"AADProvisioningLogs\",\r\n\"ADFSSignInLogs\",\r\n\"McasShadowItReporting\", \r\n\"InformationProtectionLogs_CL\", \r\n\"DeviceEvents\", \r\n\"DeviceFileEvents\", \r\n\"DeviceImageLoadEvents\", \r\n\"DeviceInfo\", \r\n\"DeviceLogonEvents\", \r\n\"DeviceNetworkEvents\", \r\n\"DeviceNetworkInfo\", \r\n\"DeviceProcessEvents\", \r\n\"DeviceRegistryEvents\",\r\n\"DeviceFileCertificateInfo\", \r\n\"EmailAttachmentInfo\", \r\n\"EmailEvents\", \r\n\"EmailPostDeliveryEvents\", \r\n\"EmailUrlInfo\",\r\n\"IdentityLogonEvents\",\r\n\"IdentityQueryEvents\",\r\n\"IdentityDirectoryEvents\",\r\n\"AlertEvidence\",\r\n\"CloudAppEvents\") \r\n| summarize DailyBillableGB = toreal(sum(Quantity))/ 1000 by Day=bin(TimeGenerated, 1d)\r\n| summarize E5UsageGB = sum(iif(toreal(DailyBillableGB)>toreal(DailyMaxDiscountGB),toreal(DailyMaxDiscountGB),DailyBillableGB)) by Day\r\n);\r\nUsage \r\n| where TimeGenerated >= StartDate and TimeGenerated < EndDate\r\n| where IsBillable == true\r\n| summarize DataGB=sum(Quantity)/1000. by Day=bin(StartTime, 1d)\r\n| extend TotalIngestionGB = DataGB \r\n| join E5 on Day\r\n| project-away Day1\r\n| extend billableGB = toreal(TotalIngestionGB) - toreal(E5UsageGB)\r\n| extend PerGBDailyCost = billableGB * real({PAYGPrice:value})\r\n| extend CommitmentTier100DailyCost = real({CT100Pricing:value}) + max_of(billableGB - 100, 0.)* real({CT100Pricing:value})/100.\r\n| extend CommitmentTier200DailyCost = real({CT200Pricing:value}) + max_of(billableGB - 200, 0.)* real({CT200Pricing:value})/200.\r\n| extend CommitmentTier300DailyCost = real({CT300Pricing:value}) + max_of(billableGB - 300, 0.)* real({CT300Pricing:value})/300.\r\n| extend CommitmentTier400DailyCost = real({CT400Pricing:value}) + max_of(billableGB - 400, 0.)* real({CT400Pricing:value})/400.\r\n| extend CommitmentTier500DailyCost = real({CT500Pricing:value}) + max_of(billableGB - 500, 0.)* real({CT500Pricing:value})/500.\r\n| extend CommitmentTier1000DailyCost = real({CT1000Pricing:value}) + max_of(billableGB - 1000, 0.)* real({CT1000Pricing:value})/1000.\r\n| extend CommitmentTier2000DailyCost = real({CT2000Pricing:value}) + max_of(billableGB - 2000, 0.)* real({CT2000Pricing:value})/2000.\r\n| extend CommitmentTier5000DailyCost = real({CT5000Pricing:value}) + max_of(billableGB - 5000, 0.)* real({CT5000Pricing:value})/5000.\r\n| summarize TotalPAYGCost = round(sum(PerGBDailyCost),2), CommitmentTier100TotalCost=round(sum(CommitmentTier100DailyCost),2), CommitmentTier200TotalCost=round(sum(CommitmentTier200DailyCost),2), CommitmentTier300TotalCost=round(sum(CommitmentTier300DailyCost),2), CommitmentTier400TotalCost=round(sum(CommitmentTier400DailyCost),2), CommitmentTier500TotalCost=round(sum(CommitmentTier500DailyCost),2), CommitmentTier1000TotalCost=round(sum(CommitmentTier1000DailyCost),2), CommitmentTier2000TotalCost=round(sum(CommitmentTier2000DailyCost),2), CommitmentTier5000TotalCost=round(sum(CommitmentTier5000DailyCost),2)\r\n| extend MinCost = min_of(\r\n TotalPAYGCost,CommitmentTier100TotalCost,CommitmentTier200TotalCost,\r\n CommitmentTier300TotalCost, CommitmentTier400TotalCost, CommitmentTier500TotalCost, CommitmentTier1000TotalCost, CommitmentTier2000TotalCost, CommitmentTier5000TotalCost)\r\n| extend Recommendation = case(\r\n MinCost == TotalPAYGCost, \"Pay-as-you-go tier\",\r\n MinCost == CommitmentTier100TotalCost, \"Commitment tier (100 GB/day)\",\r\n MinCost == CommitmentTier200TotalCost, \"Commitment tier (200 GB/day)\",\r\n MinCost == CommitmentTier300TotalCost, \"Commitment tier (300 GB/day)\",\r\n MinCost == CommitmentTier400TotalCost, \"Commitment tier (400 GB/day)\",\r\n MinCost == CommitmentTier500TotalCost, \"Commitment tier (500 GB/day)\",\r\n MinCost == CommitmentTier1000TotalCost, \"Commitment tier (1000 GB/day)\",\r\n MinCost == CommitmentTier2000TotalCost, \"Commitment tier (2000 GB/day)\",\r\n MinCost == CommitmentTier5000TotalCost, \"Commitment tier (5000 GB/day)\",\r\n \"Error\"\r\n)\r\n| project Tier = pack_array(\"PAYG\",\"CommitmentTier_100\",\"CommitmentTier_200\",\"CommitmentTier_300\",\"CommitmentTier_400\",\"CommitmentTier_500\",\"CommitmentTier_1000\",\"CommitmentTier_2000\",\"CommitmentTier_5000\",\"Recommendation\") , TotalCost = pack_array(TotalPAYGCost,CommitmentTier100TotalCost,CommitmentTier200TotalCost,CommitmentTier300TotalCost,CommitmentTier400TotalCost,CommitmentTier500TotalCost,CommitmentTier1000TotalCost,CommitmentTier2000TotalCost,CommitmentTier5000TotalCost,Recommendation)\r\n| mvexpand Tier, TotalCost\r\n",
"size": 0,
"title": "Summary and Recommendation, from {CTDateEvaluate:label} data",
"timeContextFromParameter": "CTDateEvaluate",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Tier",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "Recommendation",
"representation": "yellow",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "day",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "22ch"
}
},
{
"columnMatch": "billableGB",
"formatter": 4,
"formatOptions": {
"min": -2,
"palette": "blueLight",
"customColumnWidthSetting": "110px"
},
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "PerGBDailyCost",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "20ch"
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "CommitmentTier100DailyCost",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "32ch"
}
}
]
}
},
"conditionalVisibility": {
"parameterName": "TotalE5Seats",
"comparison": "isNotEqualTo"
},
"name": "query-CT-DailyRecommendationWithE5-Summary"
}
]
},
"name": "group-CT"
},
{
"type": 1,
"content": {
"json": "The Commitment Tier recommendation is based on the total daily ingestion cost from the selected date range (Days to evaluate).
\r\nPlease review it carefully before making a decision to change.\r\n\r\n",
"style": "info"
},
"name": "text-CT"
}
]
},
"customWidth": "70",
"name": "groupCommitmentTier"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Pricing Sku & Commitment Tier ###\r\n\r\nAs a cloud-based service, Microsoft Sentinel offers flexible pricing and commitment tiers to suit different organizational needs.
\r\n\r\nMicrosoft Sentinel offers pay-as-you-go and commitment tiers pricing model. The latter allows customers to commit to a specific amount of usage with discount which can provide significant cost savings. Choosing the right pricing model or commitment tier is critical to the cost efficiency and optimization of Microsoft Sentinel.
\r\n\r\nMicrosoft Sentinel brings together data, analytics, and workflows to unify and accelerate threat detection and response across your enterprise. Data for security analysis is stored in an Azure Monitor Log Analytics workspace where Microsoft Sentinel analyses, interacts and derives insights from large volumes of data in seconds.
\r\n\r\nMicrosoft Sentinel is billed based on the volume of data analyzed in Microsoft Sentinel and stored in the Log Analytics workspace. The cost of both is combined in a [simplified pricing tier](https://learn.microsoft.com/azure/sentinel/billing?tabs=simplified%2Ccommitment-tiers#simplified-pricing-tiers). Learn more about the simplified pricing tiers or learn more about [Microsoft Sentinel pricing](https://azure.microsoft.com/pricing/details/microsoft-sentinel/) in general.
\r\n\r\nWorkspaces older than July 2023 will have the option to switch to the **simplified pricing tiers** experience to unify billing meters, or continue to use the classic pricing tiers which separate out the Log Analytics pricing from the classic Microsoft Sentinel classic pricing.\r\n\r\nTo add further value to the new simplified tiers, the current [Microsoft Defender for Servers P2 benefit granting 500 MB/VM/day](https://learn.microsoft.com/azure/defender-for-cloud/faq-defender-for-servers#is-the-500-mb-of-free-data-ingestion-allowance-applied-per-workspace-or-per-machine-) security data ingestion into Log Analytics has been extended to the simplified pricing tiers. This greatly increases the financial benefit of bringing eligible data ingested into Microsoft Sentinel for each VM protected in this manner.\r\n\r\n**You can follow the below steps to review your pricing configurations:**\r\n\r\n\r\n1. In **Workspace Sku Summary** table, refer to 'Workspace Sku' column for the pricing tier configure for the workspace (pergb2018 = pay-as-you-go) and 'Sentinel Sku' for the pricing tier configure for Sentinel (PerGB = pay-as-you-go , Unified = simplified pricing tier).\r\n\r\n2. If capacity reservation has been configured, the pricing tier or sku will appear as 'CapacityReservation'. Refer to 'Workspace Commitment Tier' and/or 'Sentinel Commitment Tier' columns for the tier levels being set (Note: for Unified pricing, you will only find 'Sentinel Commitment Tier' column).\r\n\r\n3. Refer to **Commitment Tier Recommendations** table to review the daily ingestion pattern and determine whether your current pricing tier is optimal. Please update the parameters with the pay-as-you-go (per-GB) and commitment tier pricing details for your workspace region, see [Microsoft Sentinel pricing](https://azure.microsoft.com/pricing/details/microsoft-sentinel/). The Commitment Tier recommendation is based on the total daily ingestion cost from the selected date range (Days to evaluate). Please review it carefully before making a decision to change.\r\n\r\n
\r\n\r\nRefer to the following links on how to:\r\n\r\n* [Change pricing tier for Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/billing-reduce-costs#set-or-change-pricing-tier)\r\n\r\n* [Manage and monitor costs for Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/billing-monitor-costs)\r\n\r\n* [Microsoft Sentinel Pricing](https://azure.microsoft.com/pricing/details/microsoft-sentinel/)\r\n\r\n\r\nFor Classic pricing:\r\n\r\n* [Change pricing tier for Log Analytics workspace](https://learn.microsoft.com/azure/azure-monitor/logs/change-pricing-tier?tabs=azure-portal)\r\n\r\n* [Log Analytics Pricing](https://azure.microsoft.com/pricing/details/monitor/)",
"style": "upsell"
},
"name": "text-TopIngestionBy"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "paragraph",
"links": [
{
"id": "89bacf5f-5a82-4acf-b86c-98f85e8f13c5",
"linkTarget": "OpenBlade",
"linkLabel": "Sentinel Pricing Settings",
"preText": "",
"style": "primary",
"bladeOpenContext": {
"bladeName": "SettingsBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": [
{
"name": "subscriptionId",
"source": "static",
"value": "{Workspace:subscriptionId}"
},
{
"name": "resourceGroup",
"source": "static",
"value": "{Workspace:resourcegroup}"
},
{
"name": "workspaceName",
"source": "static",
"value": "{Workspace:name}"
}
]
}
},
{
"id": "78112e3c-d199-407b-825a-1d18dfa21fc7",
"linkTarget": "OpenBlade",
"linkLabel": "Workspace Pricing Settings",
"style": "primary",
"bladeOpenContext": {
"bladeName": "UsageAndCostsV4BladeViewModel",
"extensionName": "Microsoft_OperationsManagementSuite_Workspace",
"bladeParameters": [
{
"name": "id",
"source": "static",
"value": "{Workspace:id}"
}
]
}
}
]
},
"conditionalVisibility": {
"parameterName": "Pricing",
"comparison": "isNotEqualTo",
"value": "Unified"
},
"name": "links-PricingSettings"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "paragraph",
"links": [
{
"id": "9926ac08-4895-4a3b-b1d4-00b8c248d5ed",
"linkTarget": "OpenBlade",
"linkLabel": "Sentinel Pricing Settings",
"preText": "",
"style": "primary",
"bladeOpenContext": {
"bladeName": "SettingsBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": [
{
"name": "subscriptionId",
"source": "static",
"value": "{Workspace:subscriptionId}"
},
{
"name": "resourceGroup",
"source": "static",
"value": "{Workspace:resourcegroup}"
},
{
"name": "workspaceName",
"source": "static",
"value": "{Workspace:name}"
}
]
}
}
]
},
"conditionalVisibility": {
"parameterName": "Pricing",
"comparison": "isEqualTo",
"value": "Unified"
},
"name": "links-PricingSettings2"
}
]
},
"customWidth": "30",
"name": "groupInsights-CommitmentTier"
}
]
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "1"
},
"name": "group-PricingCommitmentTier",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "E5 Benefit Utilization",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "If you have **Microsoft 365 E5, A5, F5, and G5 and Microsoft 365 E5, A5, F5, and G5 Security licenses** in your environment, enter the **total number of seats in the parameter** below. This will be used to determine the total data grant.",
"style": "info"
},
"customWidth": "70",
"name": "text - 5"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "7b1675c0-7726-4f9e-876c-f3f7c17fa181",
"version": "KqlParameterItem/1.0",
"name": "TotalE5Seats",
"label": "Total seats (E5/A5/F5/G5)",
"type": 1,
"description": "Enter the total number of Microsoft 365 E5, A5, F5, G5 and Microsoft 365 E5, A5, F5, G5 Security licenses in your environment",
"timeContext": {
"durationMs": 86400000
},
"value": ""
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters-E5Utilization"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Usage\r\n| where IsBillable == true\r\n| where DataType in (\"SigninLogs\", \r\n\"AuditLogs\", \r\n\"AADNonInteractiveUserSignInLogs\", \r\n\"AADServicePrincipalSignInLogs\",\r\n\"AADManagedIdentitySignInLogs\",\r\n\"AADProvisioningLogs\",\r\n\"ADFSSignInLogs\",\r\n\"McasShadowItReporting\", \r\n\"InformationProtectionLogs_CL\", \r\n\"DeviceEvents\", \r\n\"DeviceFileEvents\", \r\n\"DeviceImageLoadEvents\", \r\n\"DeviceInfo\", \r\n\"DeviceLogonEvents\", \r\n\"DeviceNetworkEvents\", \r\n\"DeviceNetworkInfo\", \r\n\"DeviceProcessEvents\", \r\n\"DeviceRegistryEvents\",\r\n\"DeviceFileCertificateInfo\", \r\n\"EmailAttachmentInfo\", \r\n\"EmailEvents\", \r\n\"EmailPostDeliveryEvents\", \r\n\"EmailUrlInfo\",\r\n\"IdentityLogonEvents\",\r\n\"IdentityQueryEvents\",\r\n\"IdentityDirectoryEvents\",\r\n\"AlertEvidence\",\r\n\"CloudAppEvents\"\r\n) \r\n| summarize BillableDataGB = sum(Quantity) / 1000. by DataType\r\n| order by BillableDataGB desc\r\n\r\n",
"size": 0,
"title": "Ingestion from E5 benefit eligible data sources, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "BillableDataGB",
"formatter": 3,
"formatOptions": {
"min": 0,
"palette": "blue",
"customColumnWidthSetting": "240px"
},
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
}
],
"labelSettings": [
{
"columnId": "BillableDataGB",
"label": "BillableData"
}
]
},
"chartSettings": {
"ySettings": {
"numberFormatSettings": {
"unit": 0,
"options": {
"style": "decimal",
"useGrouping": true,
"maximumFractionDigits": 2
}
}
}
}
},
"customWidth": "95",
"name": "queryTotalIngestionGB"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Usage\r\n| where IsBillable == true\r\n| where DataType in (\"SigninLogs\", \r\n\"AuditLogs\", \r\n\"AADNonInteractiveUserSignInLogs\", \r\n\"AADServicePrincipalSignInLogs\",\r\n\"AADManagedIdentitySignInLogs\",\r\n\"AADProvisioningLogs\",\r\n\"ADFSSignInLogs\",\r\n\"McasShadowItReporting\", \r\n\"InformationProtectionLogs_CL\", \r\n\"DeviceEvents\", \r\n\"DeviceFileEvents\", \r\n\"DeviceImageLoadEvents\", \r\n\"DeviceInfo\", \r\n\"DeviceLogonEvents\", \r\n\"DeviceNetworkEvents\", \r\n\"DeviceNetworkInfo\", \r\n\"DeviceProcessEvents\", \r\n\"DeviceRegistryEvents\",\r\n\"DeviceFileCertificateInfo\", \r\n\"EmailAttachmentInfo\", \r\n\"EmailEvents\", \r\n\"EmailPostDeliveryEvents\", \r\n\"EmailUrlInfo\",\r\n\"IdentityLogonEvents\",\r\n\"IdentityQueryEvents\",\r\n\"IdentityDirectoryEvents\",\r\n\"AlertEvidence\",\r\n\"CloudAppEvents\") \r\n| summarize DailyIngestion = toreal(sum(Quantity))/ 1000 by format_datetime(TimeGenerated, 'yyyy-MM-dd') \r\n| extend MaxDataGrant = ((5*toreal({TotalE5Seats}))/1000)\r\n| sort by TimeGenerated asc\r\n",
"size": 0,
"aggregation": 3,
"title": "E5 eligible data ingestion vs Max data grant:, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "linechart",
"gridSettings": {
"formatters": [
{
"columnMatch": "IsBillable",
"formatter": 5
},
{
"columnMatch": "Table Size",
"formatter": 3,
"formatOptions": {
"palette": "greenRed"
},
"numberFormat": {
"unit": 4,
"options": {
"style": "decimal",
"maximumSignificantDigits": 2
}
}
}
]
},
"chartSettings": {
"xAxis": "TimeGenerated",
"seriesLabelSettings": [
{
"seriesName": "DailyIngestionGB",
"color": "blueDark"
},
{
"seriesName": "MaxDataGrantGB",
"color": "orange"
}
],
"showDataPoints": true,
"ySettings": {
"numberFormatSettings": {
"unit": 39,
"options": {
"style": "decimal",
"useGrouping": true,
"maximumFractionDigits": 2
}
}
}
}
},
"customWidth": "95",
"conditionalVisibility": {
"parameterName": "TotalE5Seats",
"comparison": "isNotEqualTo"
},
"name": "queryDailyE5IngestionAllocation"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let DailyMaxDiscountGB = ((5*toreal({TotalE5Seats}))/1000);\r\nUsage\r\n| where IsBillable == true\r\n| where DataType in (\"SigninLogs\", \r\n\"AuditLogs\", \r\n\"AADNonInteractiveUserSignInLogs\", \r\n\"AADServicePrincipalSignInLogs\",\r\n\"AADManagedIdentitySignInLogs\",\r\n\"AADProvisioningLogs\",\r\n\"ADFSSignInLogs\",\r\n\"McasShadowItReporting\", \r\n\"InformationProtectionLogs_CL\", \r\n\"DeviceEvents\", \r\n\"DeviceFileEvents\", \r\n\"DeviceImageLoadEvents\", \r\n\"DeviceInfo\", \r\n\"DeviceLogonEvents\", \r\n\"DeviceNetworkEvents\", \r\n\"DeviceNetworkInfo\", \r\n\"DeviceProcessEvents\", \r\n\"DeviceRegistryEvents\",\r\n\"DeviceFileCertificateInfo\", \r\n\"EmailAttachmentInfo\", \r\n\"EmailEvents\", \r\n\"EmailPostDeliveryEvents\", \r\n\"EmailUrlInfo\",\r\n\"IdentityLogonEvents\",\r\n\"IdentityQueryEvents\",\r\n\"IdentityDirectoryEvents\",\r\n\"AlertEvidence\",\r\n\"CloudAppEvents\") \r\n| summarize DailyBillableGB = toreal(sum(Quantity))/ 1000 by format_datetime(TimeGenerated, 'yy-MM-dd') \r\n| extend DailyMaxGrantGB = DailyMaxDiscountGB\r\n| summarize MaxDataGrantGB = sum(toreal(DailyMaxGrantGB))\r\n\r\n",
"size": 4,
"title": "Total E5 Data Grant Limit, {TimeRange:label}",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"gridSettings": {
"formatters": [
{
"columnMatch": "Table Size",
"formatter": 4,
"formatOptions": {
"palette": "greenRed"
},
"numberFormat": {
"unit": 2,
"options": {
"style": "decimal",
"maximumSignificantDigits": 2
}
}
}
]
},
"tileSettings": {
"titleContent": {
"columnMatch": "MaxDataGrantGB",
"formatter": 12,
"formatOptions": {
"palette": "orangeBlue"
},
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
"showBorder": false
}
},
"customWidth": "35",
"conditionalVisibility": {
"parameterName": "TotalE5Seats",
"comparison": "isNotEqualTo"
},
"name": "queryE5DataGrantLimit"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let DailyMaxDiscountGB = ((5*toreal({TotalE5Seats}))/1000);\r\nUsage\r\n| where IsBillable == true\r\n| where DataType in (\"SigninLogs\", \r\n\"AuditLogs\", \r\n\"AADNonInteractiveUserSignInLogs\", \r\n\"AADServicePrincipalSignInLogs\",\r\n\"AADManagedIdentitySignInLogs\",\r\n\"AADProvisioningLogs\",\r\n\"ADFSSignInLogs\",\r\n\"McasShadowItReporting\", \r\n\"InformationProtectionLogs_CL\", \r\n\"DeviceEvents\", \r\n\"DeviceFileEvents\", \r\n\"DeviceImageLoadEvents\", \r\n\"DeviceInfo\", \r\n\"DeviceLogonEvents\", \r\n\"DeviceNetworkEvents\", \r\n\"DeviceNetworkInfo\", \r\n\"DeviceProcessEvents\", \r\n\"DeviceRegistryEvents\",\r\n\"DeviceFileCertificateInfo\", \r\n\"EmailAttachmentInfo\", \r\n\"EmailEvents\", \r\n\"EmailPostDeliveryEvents\", \r\n\"EmailUrlInfo\",\r\n\"IdentityLogonEvents\",\r\n\"IdentityQueryEvents\",\r\n\"IdentityDirectoryEvents\",\r\n\"AlertEvidence\",\r\n\"CloudAppEvents\") \r\n| summarize DailyBillableGB = toreal(sum(Quantity))/ 1000 by format_datetime(TimeGenerated, 'yy-MM-dd') \r\n| summarize TotalEligibleGB = sum(iif(toreal(DailyBillableGB)>toreal(DailyMaxDiscountGB),toreal(DailyMaxDiscountGB),DailyBillableGB))\r\n\r\n\r\n",
"size": 4,
"title": "Total E5 Data Grant Used, {TimeRange:label}",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"gridSettings": {
"formatters": [
{
"columnMatch": "billedData",
"formatter": 4,
"formatOptions": {
"palette": "greenRed"
},
"numberFormat": {
"unit": 2,
"options": {
"style": "decimal",
"maximumSignificantDigits": 2
}
}
}
]
},
"tileSettings": {
"titleContent": {
"columnMatch": "TotalEligibleGB",
"formatter": 12,
"formatOptions": {
"palette": "coldHot"
},
"numberFormat": {
"unit": 39,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
"showBorder": false
}
},
"customWidth": "35",
"conditionalVisibility": {
"parameterName": "TotalE5Seats",
"comparison": "isNotEqualTo"
},
"name": "queryTotalEligibleE5Ingestion"
}
]
},
"customWidth": "70",
"name": "groupE5Ingestion"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### E5 Benefit Utilization ###\r\n\r\n**_Note: This section is only applicable to Microsoft 365 E5, A5, F5, and G5 and Microsoft 365 E5, A5, F5, and G5 Security customers who have Enterprise (EA), Enterprise Subscription (EAS), or Cloud Solution Provider (CSP) Agreements and Enrollments._**\r\n\r\nMicrosoft 365 E5, A5, F5, G5 and Microsoft 365 E5, A5, F5, G5 Security customers can get data grant up to **5MB per user/day** of Microsoft 365 data ingestion into Microsoft Sentinel.
\r\nThe data sources included in this offer include:\r\n\r\n- Microsoft Entra ID (Azure AD) sign-in and audit logs\r\n- Microsoft Cloud App Security shadow IT discovery logs\r\n- Microsoft Information Protection logs\r\n- Microsoft 365 advanced hunting data\r\n\r\nThe data grant will be calculated at the end of the month and applied to your bill, covering the cost of up to 5 MB of data ingestion per user/day.\r\n\r\nVisit https://azure.microsoft.com/offers/sentinel-microsoft-365-offer/ for more information\r\n\r\n
\r\n\r\n**Below are the steps to help you evaluate your utilization of Sentinel E5 benefit:**\r\n\r\n1. Enter the total number of your eligible licenses in the **Total seats** parameter\r\n\r\n2. Review table **ingestion from E5 benefit eligible data sources** and line chart **E5 eligible data ingestion vs Max data grant** to understand whether you are over/under-utilized the free data grant.\r\n\r\n3. If the data grant is underutilized (the daily total ingestion of eligible data sources is lesser than the maximum data grant), compare your data sources from table **ingestion from E5 benefit eligible data sources** against the eligibile data sources from the [offer page](https://azure.microsoft.com/offers/sentinel-microsoft-365-offer/) -> \"FAQ\" -> \"What data tables are included in this offer\" to find out if there are any eligible data sources that you supposed to connect but didn't.
\r\nThe relevant connectors are [Microsoft 365 Defender](https://learn.microsoft.com/azure/sentinel/connect-microsoft-365-defender?tabs=MDE), [Microsoft Entra ID ](https://learn.microsoft.com/azure/sentinel/connect-azure-active-directory) and [Microsoft Defender for Cloud](https://learn.microsoft.com/azure/sentinel/connect-defender-for-cloud). (_In the offering page you will find Azure Information Protection but the connector will be retired on 31 Mar 2023_).
\r\n**Note: you should consider connecting those data sources only when you have a requirement for them**\r\n\r\n4. If the data grant is overutilized (the daily total ingestion of eligible data sources is more than the maximum data grant). Review the logs and consider filtering unwanted logs using [ingestion-time transformation](https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations).\r\n\r\n",
"style": "upsell"
},
"name": "text-TopIngestionBy"
}
]
},
"customWidth": "30",
"name": "groupInsights-E5Ingestion"
}
]
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "1"
},
"name": "group-E5Utilization",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Basic Logs",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "resources\r\n| take 1\r\n| extend Basic = \"{BasicTables}\"\r\n| extend Basic = substring(Basic, 1,strlen(Basic)-2)\r\n| project BasicLogs_Table=split(Basic, ',')\r\n| mv-expand BasicLogs_Table\r\n| where isnotempty(BasicLogs_Table)\r\n| count\r\n| extend Title = \"Total Basic Logs Table\"\r\n| extend Text = \"in {Workspace:Label} workspace\"\r\n",
"size": 4,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "blue"
}
},
"secondaryContent": {
"columnMatch": "Text",
"formatter": 1
},
"showBorder": false
}
},
"customWidth": "70",
"name": "query-TotalBasicLogs"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourcegroups/{Workspace:resourcegroup}/providers/microsoft.operationalinsights/workspaces/{Workspace:name}/tables?api-version=2021-12-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value[?(@.properties.plan==\\\"Basic\\\")]\",\"columns\":[{\"path\":\"name\",\"columnid\":\"TableName\",\"columnType\":\"string\"},{\"path\":\"$..properties.schema.tableType\",\"columnid\":\"TableType\",\"columnType\":\"string\"},{\"path\":\"$..properties.totalRetentionInDays\",\"columnid\":\"TotalRetentionInDays\",\"columnType\":\"long\"},{\"path\":\"$..properties.retentionInDays\",\"columnid\":\"InteractiveRetentionInDays\",\"columnType\":\"long\"},{\"path\":\"$..properties.archiveRetentionInDays\",\"columnid\":\"ArchiveRetentionInDays\",\"columnType\":\"long\"}]}}]}",
"size": 1,
"title": "Basic Logs Table",
"noDataMessage": "Currently no Basic Logs being configured",
"queryType": 12,
"gridSettings": {
"formatters": [
{
"columnMatch": "TableName",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "20ch"
}
},
{
"columnMatch": "TableType",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "Microsoft",
"representation": "brown",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "CustomLog",
"representation": "orange",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "blue",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "14ch"
}
},
{
"columnMatch": "TotalRetentionInDays",
"formatter": 8,
"formatOptions": {
"min": 0,
"palette": "turquoise",
"customColumnWidthSetting": "24ch"
}
},
{
"columnMatch": "InteractiveRetentionInDays",
"formatter": 8,
"formatOptions": {
"min": -180,
"max": 730,
"palette": "purpleBlue",
"customColumnWidthSetting": "28ch"
}
},
{
"columnMatch": "ArchiveRetentionInDays",
"formatter": 8,
"formatOptions": {
"min": 0,
"max": 700,
"palette": "purpleDark",
"customColumnWidthSetting": "26ch"
}
}
]
}
},
"name": "query-BasicLogsTable"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Usage\r\n| where StartTime {TimeRange:value}\r\n| where IsBillable == 'true'\r\n| summarize ['Table Size'] =sum(Quantity) by DataType\r\n| order by ['Table Size'] desc\r\n| join kind= leftouter (\r\nUsage\r\n| where StartTime {TimeRange:value}\r\n| where IsBillable == 'true'\r\n| make-series IngestionTrend = sum(Quantity) default =0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DataType\r\n) on DataType\r\n| project-away DataType1, TimeGenerated",
"size": 1,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
]
},
"conditionalVisibility": {
"parameterName": "test",
"comparison": "isEqualTo",
"value": "1"
},
"name": "query-BasicLogsSizeTemp"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"315f272c-1d92-42a4-80a9-ea0c855272ad\",\"mergeType\":\"leftouter\",\"leftTable\":\"query-BasicLogsTable\",\"rightTable\":\"query-BasicLogsSizeTemp\",\"leftColumn\":\"TableName\",\"rightColumn\":\"DataType\"}],\"projectRename\":[{\"originalName\":\"[query-BasicLogsTable].TableName\",\"mergedName\":\"TableName\",\"fromId\":\"315f272c-1d92-42a4-80a9-ea0c855272ad\"},{\"originalName\":\"[query-BasicLogsSizeTemp].Table Size\",\"mergedName\":\"Table Size\",\"fromId\":\"315f272c-1d92-42a4-80a9-ea0c855272ad\"},{\"originalName\":\"[query-BasicLogsSizeTemp].IngestionTrend\",\"mergedName\":\"IngestionTrend\",\"fromId\":\"315f272c-1d92-42a4-80a9-ea0c855272ad\"},{\"originalName\":\"[query-BasicLogsTable].TableType\"},{\"originalName\":\"[query-BasicLogsTable].TotalRetentionInDays\"},{\"originalName\":\"[query-BasicLogsTable].InteractiveRetentionInDays\"},{\"originalName\":\"[query-BasicLogsTable].ArchiveRetentionInDays\"},{\"originalName\":\"[query-BasicLogsSizeTemp].DataType\"}]}",
"size": 0,
"title": "Basic Logs Table Size, from: {TimeRange:label} data",
"queryType": 7,
"gridSettings": {
"formatters": [
{
"columnMatch": "Table Size",
"formatter": 3,
"formatOptions": {
"min": 0,
"palette": "greenRed",
"customColumnWidthSetting": "240px"
},
"numberFormat": {
"unit": 38,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "IngestionTrend",
"formatter": 9,
"formatOptions": {
"min": 0,
"palette": "blue"
}
}
]
}
},
"conditionalVisibility": {
"parameterName": "BasicTables",
"comparison": "isNotEqualTo"
},
"showPin": false,
"name": "query-BasicLogsMerge"
}
]
},
"customWidth": "70",
"name": "groupTables"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Basic Logs ###\r\n\r\nIn this section, you will be presented with a list of Basic Logs tables configured in your workspace (if any). \r\n\r\nThere might be logs in your environment that generate a large volume of verbose data, but contain relatively limited security detection value. These logs can be needed for threat hunt, audit or compliance purposes but often not critical for deep analytics and alerts.\r\n\r\n**Basic Logs** is a cost-effective data plan that provides a lower cost option for ingestion of high-volume verbose logs without the full capabilities of analytics logs.\r\nBasic Logs will be accessible for interactive queries for the first 8 days. \r\nAfterwards [archived logs](https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2) can be enabled to store the data. Before configuring tables as Basic Logs, [compare log data plans](https://learn.microsoft.com/azure/azure-monitor/logs/basic-logs-configure?tabs=portal-1#compare-the-basic-and-analytics-log-data-plans) to find out more about the offering and differences between Basic Logs and default Analytics Logs.\r\n\r\n
\r\n**When should I use Basic logs?**\r\n\r\nBy default, all tables in your Log Analytics workspace are Analytics tables, and they're available for query and alerts.\r\n\r\nConfigure a table for Basic logs if:\r\n\r\n- You don't require more than eight days of data retention for the table.\r\n\r\n- You only require basic queries of the data using a [limited version of the query language](https://learn.microsoft.com/azure/azure-monitor/logs/basic-logs-query?tabs=portal-1#limitations).\r\n\r\n- The cost savings for data ingestion exceed the expected cost for any expected queries.\r\n\r\n
\r\n**For more information**, refer to the following links:\r\n\r\n\r\n- [Basic Logs use cases](https://learn.microsoft.com/azure/sentinel/basic-logs-use-cases)\r\n\r\n- [The table that supports Basic logs](https://learn.microsoft.com/azure/azure-monitor/logs/basic-logs-configure?tabs=portal-1#when-should-i-use-basic-logs)\r\n\r\n- [How to set a table's log data plan to Basic or Analytics](https://learn.microsoft.com/azure/azure-monitor/logs/basic-logs-configure?tabs=portal-1#set-a-tables-log-data-plan)\r\n\r\n- [Microsoft Sentinel Pricing Page](https://azure.microsoft.com/pricing/details/microsoft-sentinel/)\r\n",
"style": "upsell"
},
"name": "text-BasicLogs"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "list",
"links": [
{
"id": "2b8f0ca5-1278-4ea2-a851-94c61372a1a4",
"cellValue": "",
"linkTarget": "OpenBlade",
"linkLabel": "Open Tables page",
"subTarget": "test",
"style": "primary",
"bladeOpenContext": {
"bladeName": "TablesBlade",
"extensionName": "Microsoft_OperationsManagementSuite_Workspace",
"bladeParameters": [
{
"name": "workspaceResourceId",
"source": "static",
"value": "{Workspace:id}"
}
]
}
}
]
},
"name": "links-OpenRestoration"
}
]
},
"customWidth": "30",
"name": "groupInsights-BasicLogs"
}
]
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "1"
},
"name": "group-BasicLogs",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Active Restoration",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print tableRestoration = parse_json(dynamic({Restoration}))\r\n| extend tableRestoration = iif(tostring(tableRestoration) startswith \"[\",tableRestoration,todynamic(strcat(\"[\",tostring(tableRestoration), \"]\")))\r\n| mv-expand tableRestoration\r\n| evaluate bag_unpack(tableRestoration)\r\n| where provisioningState == \"Succeeded\"\r\n| summarize Total= count()\r\n| extend Title = \"Total active restored table\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "Total",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "blue"
}
},
"showBorder": false
}
},
"customWidth": "40",
"name": "query-RestorationTile"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print tableRestoration = parse_json(dynamic({Restoration}))\r\n| extend tableRestoration = iif(tostring(tableRestoration) startswith \"[\",tableRestoration, todynamic(strcat(\"[\",tostring(tableRestoration), \"]\")))\r\n| mv-expand tableRestoration\r\n| evaluate bag_unpack(tableRestoration)\r\n| where provisioningState == \"Succeeded\"\r\n| extend Days_active = datetime_diff('day',now(),createDate)\r\n| extend TableName = schema.name\r\n| top 1 by Days_active desc\r\n| extend title = \"Oldest restored table\"\r\n| extend Text = \"days\"\r\n\r\n",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Days_active",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "orange"
}
},
"rightContent": {
"columnMatch": "Text"
},
"secondaryContent": {
"columnMatch": "TableName"
},
"showBorder": false
},
"chartSettings": {
"showLegend": true
}
},
"customWidth": "40",
"conditionalVisibility": {
"parameterName": "RestorationRaw",
"comparison": "isNotEqualTo"
},
"name": "query-RestorationCount"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print tableRestoration = parse_json(dynamic({Restoration}))\r\n| extend tableRestoration = iif(tostring(tableRestoration) startswith \"[\",tableRestoration, todynamic(strcat(\"[\",tostring(tableRestoration), \"]\")))\r\n| mv-expand tableRestoration\r\n| evaluate bag_unpack(tableRestoration)\r\n| where provisioningState == \"Succeeded\"\r\n| extend TableName = schema.name\r\n| extend Days_active = datetime_diff('day',now(),createDate)\r\n| project TableName, CreatedDate = createDate, CreatedBy=createdBy,Days_active\r\n| order by Days_active desc",
"size": 0,
"title": "List of active restored table from \"{Workspace:name}\" workspace",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "TableName",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "28ch"
}
},
{
"columnMatch": "CreatedDate",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "22ch"
}
},
{
"columnMatch": "CreatedBy",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "36ch"
}
},
{
"columnMatch": "Days_active",
"formatter": 8,
"formatOptions": {
"min": 0,
"palette": "blueOrange",
"customColumnWidthSetting": "15ch"
}
}
]
}
},
"customWidth": "95",
"conditionalVisibility": {
"parameterName": "RestorationRaw",
"comparison": "isNotEqualTo"
},
"name": "query-RestoredTable"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print tableRestoration = parse_json(dynamic({Restoration}))\r\n| extend tableRestoration = iif(tostring(tableRestoration) startswith \"[\",tableRestoration, todynamic(strcat(\"[\",tostring(tableRestoration), \"]\")))\r\n| mv-expand tableRestoration\r\n| evaluate bag_unpack(tableRestoration)\r\n| where provisioningState == \"Succeeded\"\r\n| extend TableName = schema.name\r\n| extend Days_active = datetime_diff('day',now(),createDate)\r\n| summarize Count=count() by tostring(TableName), CreatedDate = createDate\r\n",
"size": 0,
"title": "Trending of active restored table from \"{Workspace:name}\" workspace",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "barchart"
},
"customWidth": "95",
"conditionalVisibility": {
"parameterName": "RestorationRaw",
"comparison": "isNotEqualTo"
},
"name": "query-RestorationTrend"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print tableRestoration = parse_json(dynamic({Restoration}))\r\n| extend tableRestoration = iif(tostring(tableRestoration) startswith \"[\",tableRestoration, todynamic(strcat(\"[\",tostring(tableRestoration), \"]\")))\r\n| mv-expand tableRestoration\r\n| evaluate bag_unpack(tableRestoration)\r\n| where provisioningState == \"Succeeded\"\r\n| extend TableName = schema.name\r\n| project CreatedDate=createDate, CreatedBy=createdBy, TableName\r\n| summarize Count = count() by CreatedBy\r\n| order by Count desc",
"size": 1,
"title": "Active restored table by CreatedBy (ObjectID)",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "Count",
"formatter": 8,
"formatOptions": {
"min": 0,
"palette": "blueOrange"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal"
}
}
}
],
"sortBy": [
{
"itemKey": "CreatedBy",
"sortOrder": 1
}
]
},
"sortBy": [
{
"itemKey": "CreatedBy",
"sortOrder": 1
}
]
},
"customWidth": "95",
"conditionalVisibility": {
"parameterName": "RestorationRaw",
"comparison": "isNotEqualTo"
},
"name": "query-RestorationCreatedBy"
}
]
},
"customWidth": "70",
"name": "groupRestoration"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Active Restoration ###\r\n\r\n**[Log data restore](https://learn.microsoft.com/azure/sentinel/restore)** can be used to restore [archived log data](https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#set-retention-and-archive-policy-by-table) into the current hot cache within Log Analytics workspace for high performing queries that support full KQL.\r\n\r\nLog data restore is charged per GB per day with a minimum charge of 2TB for 12-hour applies to every restore; pro-rated hourly. Refer to [Microsoft Sentinel pricing page](https://azure.microsoft.com/pricing/details/microsoft-sentinel/) for more information.\r\n\r\nTherefore, it is **recommended to delete the retored table when you no longer need it**. \r\n\r\n**The following steps will help you to identify active restored table in your ennvironment:**\r\n\r\n- Go through the information presented on the left to check whether there is any active restored table in your environment. Identify the created date and created by of the restored table if any.\r\n\r\n- Review the data of the restored table and check whether the data are still needed.\r\n\r\n- If the restore table is no longer needed, delete the restore table by following the instructions in the documentation [Delete restored data tables](https://learn.microsoft.com/azure/sentinel/restore#delete-restored-data-tables)\r\n\r\n- Alternatively, you can click on \"Open Search & Restoration page\" button below -> select \"Restoration\" tab, and delete the unwanted restore table.",
"style": "upsell"
},
"name": "text-Restoration"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "list",
"links": [
{
"id": "2b8f0ca5-1278-4ea2-a851-94c61372a1a4",
"cellValue": "",
"linkTarget": "OpenBlade",
"linkLabel": "Open Search & Restoration page",
"subTarget": "test",
"style": "primary",
"bladeOpenContext": {
"bladeName": "Search.ReactView",
"extensionName": "Microsoft_Azure_SentinelUS",
"bladeParameters": [
{
"name": "subscriptionId",
"source": "static",
"value": "{Subscription:id}"
},
{
"name": "resourceGroup",
"source": "static",
"value": "{Workspace:resourcegroup}"
},
{
"name": "workspaceName",
"source": "static",
"value": "{Workspace:name}"
}
]
}
}
]
},
"name": "links-OpenRestoration"
}
]
},
"customWidth": "30",
"name": "groupInsights-Restoration"
}
]
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "1"
},
"name": "group-Restoration",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Search Job",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "resources\r\n| take 1\r\n| extend SearchJob = \"{SearchJob}\"\r\n| extend SearchJob = substring(SearchJob, 1,strlen(SearchJob)-2)\r\n| project SearchJob_Table=split(SearchJob, ',')\r\n| mv-expand SearchJob_Table\r\n| where isnotempty(SearchJob_Table)\r\n| count\r\n| extend Title = \"Total SearchJob Table\"\r\n| extend Text = \"in {Workspace:Label} workspace\"\r\n",
"size": 4,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "blue"
}
},
"secondaryContent": {
"columnMatch": "Text",
"formatter": 1
},
"showBorder": false
}
},
"customWidth": "70",
"name": "query-TotalSearchJob"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Usage\r\n| take 1\r\n| extend SearchJob = \"{SearchJob}\"\r\n| extend SearchJob = substring(SearchJob, 1,strlen(SearchJob)-2)\r\n| project SearchJob=split(SearchJob, ',')\r\n| mv-expand SearchJob\r\n| summarize SearchJob_Count = count() by bin(todatetime(SearchJob), 1d)\r\n// | extend TimeGenerated = format_datetime(todatetime(SearchJob),'yyyy-MM-dd')\r\n//| make-series SearchJob=count() default=0 on TimeGenerated in range(ago(730d), now(), 1d) \r\n//| order by SearchJob asc",
"size": 0,
"title": "Search Job Count Over Time",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "barchart",
"chartSettings": {
"ySettings": {
"numberFormatSettings": {
"unit": 17,
"options": {
"style": "decimal",
"useGrouping": true
}
}
}
}
},
"customWidth": "98",
"conditionalVisibility": {
"parameterName": "SearchJob",
"comparison": "isNotEqualTo"
},
"name": "query-SearchJobTrend"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourcegroups/{Workspace:resourcegroup}/providers/microsoft.operationalinsights/workspaces/{Workspace:name}/tables?api-version=2021-12-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value[?(@.properties.schema.tableType==\\\"SearchResults\\\")]\",\"columns\":[{\"path\":\"name\",\"columnid\":\"TableName\",\"columnType\":\"string\"},{\"path\":\"properties.schema.searchResults.query\",\"columnid\":\"Query\",\"columnType\":\"string\"},{\"path\":\"properties.schema.searchResults.startSearchTime\",\"columnid\":\"StartSearchTime\"},{\"path\":\"properties.schema.searchResults.endSearchTime\",\"columnid\":\"EndSearchTime\"},{\"path\":\"systemData.createdAt\",\"columnid\":\"CreatedAt\"},{\"path\":\"systemData.createdBy\",\"columnid\":\"CreatedBy\"},{\"path\":\"properties.totalRetentionInDays\",\"columnid\":\"TotalRetentionInDays\",\"columnType\":\"long\"},{\"path\":\"properties.retentionInDays\",\"columnid\":\"InteractiveRetentionInDays\",\"columnType\":\"long\"},{\"path\":\"properties.archiveRetentionInDays\",\"columnid\":\"ArchiveRetentionInDays\",\"columnType\":\"long\"}]}}]}",
"size": 2,
"title": "Table from Search Job",
"queryType": 12,
"gridSettings": {
"formatters": [
{
"columnMatch": "TableName",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "30ch"
}
},
{
"columnMatch": "Query",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "50ch"
}
},
{
"columnMatch": "StartSearchTime",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "25ch"
}
},
{
"columnMatch": "EndSearchTime",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "25ch"
}
},
{
"columnMatch": "CreatedAt",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "25ch"
}
},
{
"columnMatch": "CreatedBy",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "37ch"
}
},
{
"columnMatch": "TotalRetentionInDays",
"formatter": 8,
"formatOptions": {
"min": 0,
"palette": "turquoise",
"customColumnWidthSetting": "24ch"
}
},
{
"columnMatch": "InteractiveRetentionInDays",
"formatter": 8,
"formatOptions": {
"min": -180,
"max": 730,
"palette": "purpleBlue",
"customColumnWidthSetting": "28ch"
}
},
{
"columnMatch": "ArchiveRetentionInDays",
"formatter": 8,
"formatOptions": {
"min": -300,
"max": 700,
"palette": "purpleDark",
"customColumnWidthSetting": "26ch"
}
}
],
"rowLimit": 1000,
"labelSettings": [
{
"columnId": "StartSearchTime",
"label": "StartSearchTime (UTC)"
},
{
"columnId": "EndSearchTime",
"label": "EndSearchTime (UTC)"
},
{
"columnId": "CreatedAt",
"label": "CreatedAt (UTC)"
},
{
"columnId": "CreatedBy",
"label": "CreatedBy (ObjectID)"
}
]
}
},
"customWidth": "98",
"name": "query-SearchTable"
}
]
},
"customWidth": "70",
"name": "groupSearchJob"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Search Job ###\r\n\r\nOne of the key features of Microsoft Sentinel is the ability to create **[Search Jobs](https://learn.microsoft.com/azure/sentinel/search-jobs)**, which enable security analysts to start an investigation to find specific events in logs up to seven years ago.\r\n\r\n You can search events across all your logs, including events in Analytics, [Basic](https://learn.microsoft.com/azure/azure-monitor/logs/basic-logs-configure?tabs=portal-1#set-a-tables-log-data-plan), and [Archived log](https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#set-retention-and-archive-policy-by-table) plans. Filter and look for events that match your criteria. The search results are stored in user-defined table and can be reused for future analysis.\r\n\r\nFor more information on search job concepts and limitations, see the below links:\r\n\r\n- [Start an investigation by searching large datasets](https://learn.microsoft.com/azure/sentinel/investigate-large-datasets) \r\n- [Run search jobs in Azure Monitor](https://learn.microsoft.com/azure/azure-monitor/logs/search-jobs?tabs=portal-1%2Cportal-2).\r\n\r\n**When to use search jobs?**\r\n\r\nUse a search job when the log query timeout of 10 minutes isn't sufficient to search through large volumes of data or if you're running a slow query.\r\n\r\nSearch jobs also let you retrieve records from Archived Logs and Basic Logs tables into a new log table you can use for queries. In this way, **running a search job can be an alternative to**:\r\n\r\n - [Restoring data from Archived Logs](https://learn.microsoft.com/azure/sentinel/restore#restore-archived-log-data) for a specific time range.\r\n Use restore when you have a temporary need to run many queries on a large volume of data.\r\n\r\n - [Querying Basic Logs](https://learn.microsoft.com/azure/azure-monitor/logs/basic-logs-query?tabs=portal-1) directly and paying for each query.\r\n To determine which alternative is more cost-effective, compare the [cost of querying Basic Logs](https://learn.microsoft.com/azure/azure-monitor/logs/basic-logs-query?tabs=portal-1#pricing-model) with the [cost of running a search job and storing the search job results](https://learn.microsoft.com/azure/azure-monitor/logs/search-jobs?tabs=portal-1%2Cportal-2#pricing-model).\r\n\r\n\r\n**Pricing model:**\r\n\r\nThe charge for a search job is based on:\r\n\r\n - Search job execution - the amount of data the search job needs to scan.\r\n\r\n - Search job results - the amount of data ingested in the results table, based on the regular log data ingestion prices.\r\n For example, if your table holds 500 GB per day, for a query on three days, you'll be charged for 1500 GB of scanned data. If the job returns 1000 records, you'll be charged for ingesting these 1000 records into the results table.\r\n\r\n \r\nFor more information, see [Pricing Model](https://learn.microsoft.com/azure/azure-monitor/logs/search-jobs?tabs=portal-1%2Cportal-2#pricing-model) and [Microsoft Sentinel Pricing](https://azure.microsoft.com/pricing/details/microsoft-sentinel/)\r\n\r\n\r\n**Recommendation:**\r\n\r\n- Review the charts/tables on the left to get visibility on how many search results table in your environment. You will find the search criteria such as query, start and end time of the search.\r\n\r\n- Security analysts should reuse existing search results if possible when the criteria are matched instead of performing a new search.\r\n\r\n- The retention of search results table will inherit workspace's interactive retention. Hence, it is important to review the retention of search results table and adjust according to your needs and requirements especially when you have workspace's interactive retention configured for more than 90 days.\r\n\r\n\r\n**Additional resources:**\r\n\r\n - [FAQ: Search, Basic Ingestion, Archive, and Data Restoration](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/faq-search-basic-ingestion-archive-and-data-restoration/ba-p/3205600#:~:text=When%20should%20I%20use%20Search,to%20specify%20a%20search%20term.)\r\n\r\n - [Training: Use Search jobs in Microsoft Sentinel]( https://learn.microsoft.com//training/modules/use-search-jobs-microsoft-sentinel/)",
"style": "upsell"
},
"name": "text-SearchJob"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "list",
"links": [
{
"id": "2b8f0ca5-1278-4ea2-a851-94c61372a1a4",
"cellValue": "",
"linkTarget": "OpenBlade",
"linkLabel": "Open Search & Restoration page",
"subTarget": "test",
"style": "primary",
"bladeOpenContext": {
"bladeName": "Search.ReactView",
"extensionName": "Microsoft_Azure_SentinelUS",
"bladeParameters": [
{
"name": "subscriptionId",
"source": "static",
"value": "{Subscription:id}"
},
{
"name": "resourceGroup",
"source": "static",
"value": "{Workspace:resourcegroup}"
},
{
"name": "workspaceName",
"source": "static",
"value": "{Workspace:name}"
}
]
}
}
]
},
"name": "links-OpenSearchJob"
}
]
},
"customWidth": "30",
"name": "groupInsights-Tables"
}
]
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "1"
},
"name": "group-Tables-SearchJob",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Data Collection Rules & Ingestion Transformations",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "fa4bf9ab-4679-45d0-9f27-f5ddddfcedfb",
"version": "KqlParameterItem/1.0",
"name": "DCRKind",
"type": 1,
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription:escapejson}/providers/Microsoft.Insights/dataCollectionRules?api-version=2022-06-01\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$..value[?(@.properties.destinations.logAnalytics[0].workspaceId==\\\"{WorkspaceID}\\\")]\",\"columns\":[{\"path\":\"kind\",\"columnid\":\"kind\"}]}}]}",
"isHiddenWhenLocked": true,
"timeContext": {
"durationMs": 86400000
},
"queryType": 12
}
],
"style": "pills",
"queryType": 12
},
"conditionalVisibility": {
"parameterName": "Test",
"comparison": "isEqualTo",
"value": "1"
},
"name": "parameters-DCRKind"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "resources\r\n| take 1\r\n| extend DCRKind = \"{DCRKind}\"\r\n| extend DCRKind = substring(DCRKind, 1,strlen(DCRKind)-2)\r\n| project DCRKind_Total=split(DCRKind, ',')\r\n| mv-expand DCRKind_Total\r\n| count\r\n| extend Title = \"Total DCR\"\r\n| extend Text = \"for {Workspace:Label} workspace\"",
"size": 4,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "blue"
}
},
"rightContent": {
"columnMatch": "Text2"
},
"secondaryContent": {
"columnMatch": "Text",
"formatter": 1
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-TotalDCR"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print dataFlows = parse_json(dynamic({DCRDataFlows}))\r\n| mv-expand dataFlows\r\n| where isnotempty(dataFlows)\r\n| where dataFlows has \"transformKql\"\r\n| count\r\n| extend Title = \"DCR with Transformation\"\r\n| extend Text = \"for {Workspace:Label} workspace\"\r\n",
"size": 4,
"timeContext": {
"durationMs": 1800000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "blue"
}
},
"rightContent": {
"columnMatch": "Text2"
},
"secondaryContent": {
"columnMatch": "Text",
"formatter": 1
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-TotalDCRTransform"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print dataFlows = dynamic({DCRDataFlows})\r\n| mv-expand dataFlows\r\n| mv-expand dataFlows\r\n| where dataFlows has \"transformKql\"\r\n| parse kind=regex dataFlows.streams with * \"(Microsoft-(Table-)|Custom-(Table-))\" DataSource '\"'\r\n| summarize Count = dcount(DataSource)\r\n| extend Title = \"Table with Transformation\"\r\n| extend Text = \"in {Workspace:Label} workspace\"\r\n",
"size": 4,
"timeContext": {
"durationMs": 1800000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "blue"
}
},
"rightContent": {
"columnMatch": "Text2"
},
"secondaryContent": {
"columnMatch": "Text",
"formatter": 1
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-TotalTransformTable"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "resources\r\n| take 1\r\n| extend DCRKind = \"{DCRKind}\"\r\n| extend DCRKind = substring(DCRKind, 1,strlen(DCRKind)-2)\r\n| project DCRKind=split(DCRKind, ',')\r\n| mv-expand DCRKind\r\n| summarize count() by tostring(DCRKind)\r\n\r\n",
"size": 1,
"title": "DCR by Type (with \"{Workspace:Label}\" workspace as destination)",
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "piechart",
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "blue"
}
},
"rightContent": {
"columnMatch": "Text2"
},
"secondaryContent": {
"columnMatch": "Text",
"formatter": 1
},
"showBorder": false
}
},
"name": "query-DCRbyKind"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "resources | where type =~ 'Microsoft.operationsmanagement/solutions' | where name contains 'SecurityInsights' \r\n| project Workspace = tostring(properties.workspaceResourceId)\r\n| where Workspace == \"{Workspace}\"",
"size": 4,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources",
"crossComponentResources": [
"{Subscription}"
]
},
"conditionalVisibility": {
"parameterName": "test",
"comparison": "isEqualTo",
"value": "1"
},
"name": "query-Workspace"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription:escapejson}/providers/Microsoft.Insights/dataCollectionRules\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2021-09-01-preview\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value[*]\",\"columns\":[{\"path\":\"id\",\"columnid\":\"id\"},{\"path\":\"$\",\"columnid\":\"properties\"},{\"path\":\"kind\",\"columnid\":\"kind\"},{\"path\":\"location\",\"columnid\":\"location\"},{\"path\":\"properties.provisioningState\",\"columnid\":\"provisioningState\"},{\"path\":\"name\",\"columnid\":\"name\"},{\"path\":\"properties.dataSources.syslog\",\"columnid\":\"syslog\"},{\"path\":\"properties.dataSources.windowsEventLogs[*]\",\"columnid\":\"windowsEventLogs\"},{\"path\":\"properties.dataSources.windowsEventLogs[*].streams[?(@ ==\\\"Microsoft-SecurityEvent\\\")]\",\"columnid\":\"securityEvents\"},{\"path\":\"properties.dataCollectionEndpointId\",\"columnid\":\"dataCollectionEndpointId\"},{\"path\":\"properties.dataFlows[?(@.transformKql != \\\"source\\\")].transformKql\",\"columnid\":\"transformKql\"},{\"path\":\"properties.destinations\",\"columnid\":\"destinations\"},{\"path\":\"properties.dataFlows[*].transformKql\",\"columnid\":\"queries\"},{\"path\":\"properties.dataSources\",\"columnid\":\"dataSources\"},{\"path\":\"properties.dataFlows\",\"columnid\":\"dataFlows\"},{\"path\":\"description\",\"columnid\":\"description\"},{\"path\":\"properties.destinations.logAnalytics.*.name\",\"columnid\":\"destinationName\"},{\"path\":\"systemData.lastModifiedBy\",\"columnid\":\"lastModifiedBy\"},{\"path\":\"properties.destinations.logAnalytics.*.workspaceResourceId\",\"columnid\":\"workspaceResourceId\"}]}}]}",
"size": 2,
"title": "List of Currently Configured Data Collection Rules",
"exportToExcelOptions": "all",
"queryType": 12,
"gridSettings": {
"formatters": [
{
"columnMatch": "id",
"formatter": 13,
"formatOptions": {
"linkColumn": "id",
"linkTarget": "Resource",
"linkIsContextBlade": true,
"showIcon": true
}
},
{
"columnMatch": "properties",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkLabel": "📋",
"linkIsContextBlade": true,
"customColumnWidthSetting": "5ch"
}
},
{
"columnMatch": "kind",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "is Empty",
"representation": "Capture",
"text": "{0}{1} Custom"
},
{
"operator": "contains",
"thresholdValue": "Linux",
"representation": "Console",
"text": "{0}{1}"
},
{
"operator": "contains",
"thresholdValue": "Windows",
"representation": "Initial_Access",
"text": "{0}{1}"
},
{
"operator": "contains",
"thresholdValue": "WorkspaceTransforms",
"representation": "Persistence",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "17ch"
}
},
{
"columnMatch": "location",
"formatter": 17,
"formatOptions": {
"customColumnWidthSetting": "94px"
}
},
{
"columnMatch": "provisioningState",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "contains",
"thresholdValue": "succeeded",
"representation": "success",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "17ch"
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "name",
"formatter": 5
},
{
"columnMatch": "syslog",
"formatter": 18,
"formatOptions": {
"linkTarget": "CellDetails",
"subTarget": "2",
"linkIsContextBlade": true,
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "is Empty",
"representation": "cancelled",
"text": "Not Configured"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "Enabled"
}
],
"bladeOpenContext": {
"bladeName": "DataCollectionRulesDataSourceManagementViewModel",
"extensionName": "Microsoft_Azure_Monitoring",
"bladeParameters": [
{
"name": "id",
"source": "column",
"value": "id"
}
]
},
"customColumnWidthSetting": "20ch"
}
},
{
"columnMatch": "windowsEventLogs",
"formatter": 18,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true,
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "is Empty",
"representation": "cancelled",
"text": "Not Configured"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "Configured"
}
],
"customColumnWidthSetting": "20ch"
}
},
{
"columnMatch": "securityEvents",
"formatter": 18,
"formatOptions": {
"linkColumn": "windowsEventLogs",
"linkTarget": "CellDetails",
"linkIsContextBlade": true,
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "is Empty",
"representation": "cancelled",
"text": "Not Configured"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "Configured"
}
],
"customColumnWidthSetting": "20ch"
}
},
{
"columnMatch": "dataCollectionEndpointId",
"formatter": 18,
"formatOptions": {
"linkTarget": "Resource",
"linkIsContextBlade": true,
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "is Empty",
"representation": "cancelled",
"text": "Not Configured"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "Configured"
}
],
"customColumnWidthSetting": "21.7143ch"
}
},
{
"columnMatch": "transformKql",
"formatter": 18,
"formatOptions": {
"linkColumn": "queries",
"linkTarget": "CellDetails",
"linkIsContextBlade": true,
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "is Empty",
"representation": "stopped",
"text": "Not Configured"
},
{
"operator": "contains",
"thresholdValue": "Workspace",
"representation": "success",
"text": "Ingestion KQL"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "Custom KQL"
}
],
"bladeOpenContext": {
"bladeName": "CreateMicrosoftTableTransformBlade",
"extensionName": "Microsoft_OperationsManagementSuite_Workspace",
"bladeJsonParameters": "{\r\n\t\"workspaceResourceId\" : \"{workspace}\",\r\n\t\"providers\" : \"microsoft.operationalinsights\",\r\n\t\"table\" : { \r\n\t\t\"name\" : \"{selectedTableName}\",\r\n\t\t\"description\":\"Security events collected from windows machines by Azure Security Center or Azure Sentinel.\",\r\n\t\t\"hasData\":true,\r\n\t\t\"tableType\":\"Microsoft\",\r\n\t\t\"tableAPIState\":\"Any\",\r\n\t\t\"solutions\":[\"Security and Audit\",\"Microsoft Sentinel\"],\r\n\t\t\"categories\":[\"Security\"],\r\n\t\t\"retentionInDaysAsDefault\":false,\r\n\t\t\"totalRetentionInDaysAsDefault\":false,\r\n\t\t\"isEditTransformationEnabled\":true,\r\n\t\t\"isCreateTransformationEnabled\":true\r\n\t},\r\n\t\"isMicrosoftTable\" : true,\r\n\t\"isMigrationRequired\" : false\r\n}"
},
"customColumnWidthSetting": "22ch"
}
},
{
"columnMatch": "destinations",
"formatter": 5
},
{
"columnMatch": "queries",
"formatter": 5
},
{
"columnMatch": "dataSources",
"formatter": 5
},
{
"columnMatch": "dataFlows",
"formatter": 5,
"formatOptions": {
"aggregation": "Sum"
}
},
{
"columnMatch": "description",
"formatter": 5
},
{
"columnMatch": "destinationName",
"formatter": 5
},
{
"columnMatch": "lastModifiedBy",
"formatter": 5
},
{
"columnMatch": "workspaceResourceId",
"formatter": 13,
"formatOptions": {
"linkTarget": "Resource",
"showIcon": true,
"customColumnWidthSetting": "16.8571ch"
}
},
{
"columnMatch": "customEvents",
"formatter": 18,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true,
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "is Empty",
"representation": "cancelled",
"text": "Not Configured"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "Configured"
}
],
"customColumnWidthSetting": "20ch"
}
},
{
"columnMatch": "StepTab",
"formatter": 5
}
],
"rowLimit": 1000,
"sortBy": [
{
"itemKey": "$gen_link_id_0",
"sortOrder": 1
}
],
"labelSettings": [
{
"columnId": "id",
"label": "Data Collection Rule"
},
{
"columnId": "properties",
"label": " properties"
},
{
"columnId": "kind",
"label": "Rule Type"
},
{
"columnId": "location",
"label": "Location"
},
{
"columnId": "provisioningState",
"label": "Provisioned",
"comment": "State of configuration "
},
{
"columnId": "syslog",
"label": "Syslog"
},
{
"columnId": "windowsEventLogs",
"label": "Windows Events"
},
{
"columnId": "securityEvents",
"label": "Security Events"
},
{
"columnId": "dataCollectionEndpointId",
"label": "Collection Endpoint"
},
{
"columnId": "transformKql",
"label": "Ingestion Transform"
},
{
"columnId": "destinations",
"label": "Destinations"
},
{
"columnId": "workspaceResourceId",
"label": "Workspace"
}
]
},
"sortBy": [
{
"itemKey": "$gen_link_id_0",
"sortOrder": 1
}
]
},
"conditionalVisibility": {
"parameterName": "test",
"comparison": "isEqualTo",
"value": "1"
},
"name": "query-DCR-Temp",
"styleSettings": {
"showBorder": true
}
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"a11c31f5-0e8e-43f9-b1fc-2dc82e4510fc\",\"mergeType\":\"inner\",\"leftTable\":\"query-DCR-Temp\",\"rightTable\":\"query-Workspace\",\"leftColumn\":\"workspaceResourceId\",\"rightColumn\":\"Workspace\"}],\"projectRename\":[{\"originalName\":\"[query-DCR-Temp].id\",\"mergedName\":\"Data Collection Rule\",\"fromId\":\"a11c31f5-0e8e-43f9-b1fc-2dc82e4510fc\"},{\"originalName\":\"[query-DCR-Temp].properties\",\"mergedName\":\" properties\",\"fromId\":\"a11c31f5-0e8e-43f9-b1fc-2dc82e4510fc\"},{\"originalName\":\"[query-DCR-Temp].kind\",\"mergedName\":\"Rule Type\",\"fromId\":\"a11c31f5-0e8e-43f9-b1fc-2dc82e4510fc\"},{\"originalName\":\"[query-DCR-Temp].location\",\"mergedName\":\"Location\",\"fromId\":\"a11c31f5-0e8e-43f9-b1fc-2dc82e4510fc\"},{\"originalName\":\"[query-DCR-Temp].provisioningState\",\"mergedName\":\"Provisioned\",\"fromId\":\"a11c31f5-0e8e-43f9-b1fc-2dc82e4510fc\"},{\"originalName\":\"[query-DCR-Temp].name\",\"mergedName\":\"name\",\"fromId\":\"a11c31f5-0e8e-43f9-b1fc-2dc82e4510fc\"},{\"originalName\":\"[query-DCR-Temp].syslog\",\"mergedName\":\"Syslog\",\"fromId\":\"a11c31f5-0e8e-43f9-b1fc-2dc82e4510fc\"},{\"originalName\":\"[query-DCR-Temp].windowsEventLogs\",\"mergedName\":\"Windows Events\",\"fromId\":\"a11c31f5-0e8e-43f9-b1fc-2dc82e4510fc\"},{\"originalName\":\"[query-DCR-Temp].securityEvents\",\"mergedName\":\"Security Events\",\"fromId\":\"a11c31f5-0e8e-43f9-b1fc-2dc82e4510fc\"},{\"originalName\":\"[query-DCR-Temp].dataCollectionEndpointId\",\"mergedName\":\"Collection Endpoint\",\"fromId\":\"a11c31f5-0e8e-43f9-b1fc-2dc82e4510fc\"},{\"originalName\":\"[query-DCR-Temp].transformKql\",\"mergedName\":\"Ingestion Transform\",\"fromId\":\"a11c31f5-0e8e-43f9-b1fc-2dc82e4510fc\"},{\"originalName\":\"[query-DCR-Temp].destinations\",\"mergedName\":\"Destinations\",\"fromId\":\"a11c31f5-0e8e-43f9-b1fc-2dc82e4510fc\"},{\"originalName\":\"[query-DCR-Temp].queries\",\"mergedName\":\"queries\",\"fromId\":\"a11c31f5-0e8e-43f9-b1fc-2dc82e4510fc\"},{\"originalName\":\"[query-DCR-Temp].dataSources\",\"mergedName\":\"dataSources\",\"fromId\":\"a11c31f5-0e8e-43f9-b1fc-2dc82e4510fc\"},{\"originalName\":\"[query-DCR-Temp].dataFlows\",\"mergedName\":\"dataFlows\",\"fromId\":\"a11c31f5-0e8e-43f9-b1fc-2dc82e4510fc\"},{\"originalName\":\"[query-DCR-Temp].description\",\"mergedName\":\"description\",\"fromId\":\"a11c31f5-0e8e-43f9-b1fc-2dc82e4510fc\"},{\"originalName\":\"[query-DCR-Temp].destinationName\",\"mergedName\":\"destinationName\",\"fromId\":\"a11c31f5-0e8e-43f9-b1fc-2dc82e4510fc\"},{\"originalName\":\"[query-DCR-Temp].lastModifiedBy\",\"mergedName\":\"lastModifiedBy\",\"fromId\":\"a11c31f5-0e8e-43f9-b1fc-2dc82e4510fc\"},{\"originalName\":\"[query-DCR-Temp].workspaceResourceId\",\"mergedName\":\"Workspace\",\"fromId\":\"a11c31f5-0e8e-43f9-b1fc-2dc82e4510fc\"},{\"originalName\":\"[query-Workspace].Workspace\",\"mergedName\":\"Workspace1\",\"fromId\":\"a11c31f5-0e8e-43f9-b1fc-2dc82e4510fc\"},{\"originalName\":\"[query-DCR-Temp].workspaceResourceId\"}]}",
"size": 0,
"title": "List of Data Collection Rules with \"{Workspace:label}\" workspace as destination",
"exportedParameters": [
{
"fieldName": "Data Collection Rule",
"parameterName": "DCRId"
},
{
"fieldName": "name",
"parameterName": "DCRname",
"parameterType": 1
}
],
"queryType": 7,
"gridSettings": {
"formatters": [
{
"columnMatch": "Data Collection Rule",
"formatter": 13,
"formatOptions": {
"linkColumn": "Data Collection Rule",
"linkTarget": "Resource",
"linkIsContextBlade": false,
"showIcon": true,
"customColumnWidthSetting": "29ch"
}
},
{
"columnMatch": " properties",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkLabel": "📋",
"linkIsContextBlade": true,
"customColumnWidthSetting": "3.5ch"
}
},
{
"columnMatch": "Rule Type",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "is Empty",
"representation": "Capture",
"text": "{0}{1} Custom"
},
{
"operator": "contains",
"thresholdValue": "Linux",
"representation": "Console",
"text": "{0}{1}"
},
{
"operator": "contains",
"thresholdValue": "Windows",
"representation": "Initial_Access",
"text": "{0}{1}"
},
{
"operator": "contains",
"thresholdValue": "WorkspaceTransforms",
"representation": "Persistence",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "22.5ch"
}
},
{
"columnMatch": "Location",
"formatter": 5
},
{
"columnMatch": "Provisioned",
"formatter": 5
},
{
"columnMatch": "name",
"formatter": 5
},
{
"columnMatch": "Syslog",
"formatter": 18,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true,
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "is Empty",
"representation": "cancelled",
"text": "Not Configured"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "Configured"
}
],
"customColumnWidthSetting": "18ch"
}
},
{
"columnMatch": "Windows Events",
"formatter": 18,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true,
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "is Empty",
"representation": "cancelled",
"text": "Not Configured"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "Configured"
}
],
"customColumnWidthSetting": "19ch"
}
},
{
"columnMatch": "Security Events",
"formatter": 18,
"formatOptions": {
"linkColumn": "Windows Events",
"linkTarget": "CellDetails",
"linkIsContextBlade": true,
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "is Empty",
"representation": "cancelled",
"text": "Not Configured"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "Configured"
}
],
"customColumnWidthSetting": "18ch"
}
},
{
"columnMatch": "Collection Endpoint",
"formatter": 18,
"formatOptions": {
"linkTarget": "Resource",
"linkIsContextBlade": false,
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "is Empty",
"representation": "cancelled",
"text": "Not Configured"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "Configured"
}
],
"customColumnWidthSetting": "22ch"
}
},
{
"columnMatch": "Ingestion Transform",
"formatter": 18,
"formatOptions": {
"linkColumn": "queries",
"linkTarget": "CellDetails",
"linkIsContextBlade": true,
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "is Empty",
"representation": "stopped",
"text": "Configured"
},
{
"operator": "contains",
"thresholdValue": "Workspace",
"representation": "success",
"text": "Configured"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "Custom KQL"
}
],
"customColumnWidthSetting": "22ch"
}
},
{
"columnMatch": "Destinations",
"formatter": 5
},
{
"columnMatch": "queries",
"formatter": 5
},
{
"columnMatch": "dataSources",
"formatter": 5
},
{
"columnMatch": "dataFlows",
"formatter": 5
},
{
"columnMatch": "description",
"formatter": 5
},
{
"columnMatch": "destinationName",
"formatter": 5
},
{
"columnMatch": "lastModifiedBy",
"formatter": 5
},
{
"columnMatch": "Workspace",
"formatter": 5
},
{
"columnMatch": "Workspace1",
"formatter": 5
}
],
"labelSettings": [
{
"columnId": " properties",
"label": " "
}
]
}
},
"customWidth": "99.5",
"name": "query-DCR"
},
{
"type": 1,
"content": {
"json": "Select a Windows/Linux DCR in the above table to view the associated VMs ",
"style": "info"
},
"conditionalVisibilities": [
{
"parameterName": "Help",
"comparison": "isEqualTo",
"value": "Yes"
},
{
"parameterName": "DCRname",
"comparison": "isEqualTo"
}
],
"name": "text-DCRSelect"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{DCRId}/associations\",\"urlParams\":[{\"key\":\"api-version\",\"value\":\"2019-11-01-preview\"}],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"id\",\"columnid\":\"VMs\",\"columnType\":\"string\",\"substringRegexMatch\":\"(\\\\/subscriptions.*)(\\\\/providers.*|Providers.*)\",\"substringReplace\":\"$1\"}]}}]}",
"size": 0,
"title": "VMs associated with the selected DCR: '{DCRname}'",
"noDataMessage": "No VMs associated with the selected DCR above",
"queryType": 12,
"gridSettings": {
"rowLimit": 10000,
"filter": true
}
},
"customWidth": "99.5",
"conditionalVisibility": {
"parameterName": "DCRname",
"comparison": "isNotEqualTo"
},
"name": "query-DCE-VM"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print dataFlows = dynamic({DCRDataFlows})\r\n| mv-expand dataFlows\r\n| where dataFlows has \"transformKql\"\r\n| extend dataFlows = iif (dataFlows startswith \"[\",dataFlows,todynamic(strcat(\"[\",tostring(dataFlows),\"]\")))\r\n| extend dataFlow = dataFlows\r\n| mv-expand dataFlow\r\n| parse kind=regex dataFlow.streams with * \"(Microsoft-(Table-)|Custom-(Table-))\" DataSource '\"'\r\n| extend TransformKQL = dataFlow.transformKql\r\n| where TransformKQL != \"source\"\r\n| extend DestinationTable = iif(isempty(dataFlow.outputStream),DataSource,dataFlow.outputStream)\r\n| project-away dataFlow\r\n\r\n",
"size": 1,
"timeContext": {
"durationMs": 1800000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "table",
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "blue"
}
},
"rightContent": {
"columnMatch": "Text2"
},
"secondaryContent": {
"columnMatch": "Text",
"formatter": 1
},
"showBorder": false
}
},
"conditionalVisibility": {
"parameterName": "test",
"comparison": "isEqualTo",
"value": "1"
},
"name": "query-DCRTransformTableTemp"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"fd46a877-1f8e-4b77-9d10-4c1496f2a0d5\",\"mergeType\":\"leftouter\",\"leftTable\":\"query-DCRTransformTableTemp\",\"rightTable\":\"query-DCR-Temp\",\"leftColumn\":\"dataFlows\",\"rightColumn\":\"dataFlows\"}],\"projectRename\":[{\"originalName\":\"[query-DCRTransformTableTemp].dataFlows\",\"mergedName\":\"dataFlows\",\"fromId\":\"fd46a877-1f8e-4b77-9d10-4c1496f2a0d5\"},{\"originalName\":\"[query-DCRTransformTableTemp].DataSource\",\"mergedName\":\"DataSource\",\"fromId\":\"fd46a877-1f8e-4b77-9d10-4c1496f2a0d5\"},{\"originalName\":\"[query-DCRTransformTableTemp].TransformKQL\",\"mergedName\":\"TransformKQL\",\"fromId\":\"fd46a877-1f8e-4b77-9d10-4c1496f2a0d5\"},{\"originalName\":\"[query-DCRTransformTableTemp].DestinationTable\",\"mergedName\":\"Destination\",\"fromId\":\"fd46a877-1f8e-4b77-9d10-4c1496f2a0d5\"},{\"originalName\":\"[query-DCR-Temp].id\",\"mergedName\":\"Data Collection Rule\",\"fromId\":\"fd46a877-1f8e-4b77-9d10-4c1496f2a0d5\"},{\"originalName\":\"[query-DCR-Temp].properties\",\"mergedName\":\" properties\",\"fromId\":\"fd46a877-1f8e-4b77-9d10-4c1496f2a0d5\"},{\"originalName\":\"[query-DCR-Temp].kind\",\"mergedName\":\"Rule Type\",\"fromId\":\"fd46a877-1f8e-4b77-9d10-4c1496f2a0d5\"},{\"originalName\":\"[query-DCR-Temp].location\",\"mergedName\":\"Location\",\"fromId\":\"fd46a877-1f8e-4b77-9d10-4c1496f2a0d5\"},{\"originalName\":\"[query-DCR-Temp].provisioningState\",\"mergedName\":\"Provisioned\",\"fromId\":\"fd46a877-1f8e-4b77-9d10-4c1496f2a0d5\"},{\"originalName\":\"[query-DCR-Temp].name\",\"mergedName\":\"name\",\"fromId\":\"fd46a877-1f8e-4b77-9d10-4c1496f2a0d5\"},{\"originalName\":\"[query-DCR-Temp].lastModifiedBy\",\"mergedName\":\"lastModifiedBy\",\"fromId\":\"fd46a877-1f8e-4b77-9d10-4c1496f2a0d5\"},{\"originalName\":\"[query-DCR-Temp].workspaceResourceId\",\"mergedName\":\"Workspace\",\"fromId\":\"fd46a877-1f8e-4b77-9d10-4c1496f2a0d5\"},{\"originalName\":\"[query-DCR-Temp].syslog\"},{\"originalName\":\"[query-DCR-Temp].windowsEventLogs\"},{\"originalName\":\"[query-DCR-Temp].securityEvents\"},{\"originalName\":\"[query-DCR-Temp].dataCollectionEndpointId\"},{\"originalName\":\"[query-DCR-Temp].transformKql\"},{\"originalName\":\"[query-DCR-Temp].destinations\"},{\"originalName\":\"[query-DCR-Temp].queries\"},{\"originalName\":\"[query-DCR-Temp].dataSources\"},{\"originalName\":\"[query-DCR-Temp].dataFlows\"},{\"originalName\":\"[query-DCR-Temp].description\"},{\"originalName\":\"[query-DCR-Temp].destinationName\"}]}",
"size": 0,
"title": "List of Tables with Ingestion Transformation Configured",
"queryType": 7,
"gridSettings": {
"formatters": [
{
"columnMatch": "dataFlows",
"formatter": 5
},
{
"columnMatch": "DataSource",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "24ch"
}
},
{
"columnMatch": "TransformKQL",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "47ch"
}
},
{
"columnMatch": "Destination",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "24ch"
}
},
{
"columnMatch": "Data Collection Rule",
"formatter": 13,
"formatOptions": {
"linkTarget": "Resource",
"linkIsContextBlade": false,
"showIcon": true,
"customColumnWidthSetting": "29ch"
}
},
{
"columnMatch": " properties",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkLabel": "📋",
"linkIsContextBlade": true,
"customColumnWidthSetting": "4ch"
}
},
{
"columnMatch": "Rule Type",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "is Empty",
"representation": "Capture",
"text": "{0}{1} Custom"
},
{
"operator": "contains",
"thresholdValue": "Linux",
"representation": "Console",
"text": "{0}{1}"
},
{
"operator": "contains",
"thresholdValue": "Windows",
"representation": "Initial_Access",
"text": "{0}{1}"
},
{
"operator": "contains",
"thresholdValue": "WorkspaceTransform",
"representation": "Persistence",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "25ch"
}
},
{
"columnMatch": "Location",
"formatter": 5
},
{
"columnMatch": "Provisioned",
"formatter": 5
},
{
"columnMatch": "name",
"formatter": 5
},
{
"columnMatch": "lastModifiedBy",
"formatter": 5
},
{
"columnMatch": "Workspace",
"formatter": 5
}
],
"labelSettings": [
{
"columnId": " properties",
"label": " "
}
]
}
},
"showPin": false,
"name": "query-DCRTransformTable"
}
]
},
"customWidth": "70",
"name": "groupDCRTransform"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Data Collection Rule & Ingestion Transformation ###\r\n\r\nAs organizations expanding their digital estate, the amount of data generated can become overwhelming. [Data transformation in Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/data-transformation) can help organizations optimize data collection and reduce costs by using [Data Collection Rules (DCR)](https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview) to apply basic KQL queries to incoming standard logs (and [DCR-based custom logs](https://learn.microsoft.com/azure/azure-monitor/logs/custom-logs-migrate)) before they're stored in your workspace. This allows you to filter and enrich standard tables and to create highly customizable tables for storing data from sources that produce unique log formats.\r\n\r\nThe tiles and tables on the left will display a list of Data Collection Rules in your environment and Data Transformation details (if available).\r\n**If you have not configured any Data Transformations and would like to know more, please refer to the below information:**\r\n\r\n\r\n\r\n
\r\n#### **Use cases and sample scenarios:**\r\n\r\n 1) **Filtering**
\r\n\tIngestion-time transformation provides you with the ability to filter out irrelevant data even before it's first stored in your workspace.\r\n\tYou can filter at the record (row) level, by specifying criteria for which records to include, or at the field (column) level, by removing the content for specific fields. \r\n\r\n2) **Normalization**
\r\n\tIngest-time transformation also allows you to normalize logs when ingested into built-in or customer ASIM normalized tables. Using ingest-time normalization improves normalized queries performance.\r\n\r\n3) **Enrichment and tagging**
\r\n\tIngestion-time transformation also lets you improve analytics by enriching your data with extra columns added to the configured KQL transformation. Extra columns might include parsed or calculated data from existing columns, or data taken from data structures created on-the-fly.\r\n\r\n4) **Masking**
\r\n\tIngestion-time transformations can also be used to mask or remove personal information. For example, you might use data transformation to mask all but the last digits of a social security number or credit card number, or you could replace other types of personal data with nonsense, standard text, or dummy data.\r\n\r\n_For more information, refer to [Use cases and sample scenarios](https://learn.microsoft.com/azure/sentinel/data-transformation#use-cases-and-sample-scenarios) and [Why to use transformations](https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#why-to-use-transformations)_ \r\n\r\n
\r\n#### **How transformations work:**\r\n\r\nTransformations are defined in a [data collection rule (DCR)](https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview) and use a [Kusto Query Language (KQL) statement](https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations-structure) that's applied individually to each entry in the incoming data. It must understand the format of the incoming data and create output in the structure expected by the destination.\r\n\r\n**No filtering ingestion charge** regardless of how much data the transformation filters for Microsoft Sentinel enabled workspaces.\r\n\r\nYou can apply transformation to the following tables in a workspace:\r\n\r\n - [Supported native tables](https://learn.microsoft.com/azure/azure-monitor/logs/tables-feature-support)\r\n\r\n - [DCR-based custom table](https://learn.microsoft.com/azure/azure-monitor/logs/custom-logs-migrate)\r\n\r\nRefer to the following links for more details:\r\n\r\n - [How transformations work](https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#how-transformations-work)\r\n\r\n- [Transform data at ingestion time](https://learn.microsoft.com/azure/sentinel/configure-data-transformation)\r\n\r\n- [Supported KQL](https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations-structure#supported-kql-features)\r\n\r\n
\r\n#### **Additional resources:**\r\n\r\n - [Tutorial: Add a transformation in a workspace data collection rule by using the Azure portal](https://learn.microsoft.com/azure/azure-monitor/logs/tutorial-workspace-transformations-portal)\r\n\r\n - [Tutorial: Add transformation in workspace data collection rule to Azure Monitor using Resource Manager templates](https://learn.microsoft.com/azure/azure-monitor/logs/tutorial-workspace-transformations-api)\r\n\r\n - [Tutorial: Transform text logs during ingestion in Azure Monitor Logs](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-transformation)\r\n\r\n - [Microsoft Sentinel Transformations Library](https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Transformations-Library)\r\n",
"style": "upsell"
},
"name": "text-DCR"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "list",
"links": [
{
"id": "2b8f0ca5-1278-4ea2-a851-94c61372a1a4",
"cellValue": "",
"linkTarget": "OpenBlade",
"linkLabel": "Open Tables page",
"subTarget": "test",
"style": "primary",
"bladeOpenContext": {
"bladeName": "TablesBlade",
"extensionName": "Microsoft_OperationsManagementSuite_Workspace",
"bladeParameters": [
{
"name": "workspaceResourceId",
"source": "static",
"value": "{Workspace:id}"
}
]
}
}
]
},
"name": "links-OpenTableTransform"
}
]
},
"customWidth": "30",
"name": "groupInsights-DCR"
}
]
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "1"
},
"name": "group-DCR",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Number of Incidents with Automation Used",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where Status != 'Closed'\r\n| where LastModifiedTime != CreatedTime\r\n| where ModifiedBy has_any ('playbook', 'automation rule')\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| summarize Count = count() by IncidentNumber, ModifiedBy, bin(TimeGenerated, 1d)\r\n| project-away IncidentNumber",
"size": 0,
"showAnalytics": true,
"title": "Total Automation Actions on Incidents",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart"
},
"customWidth": "95",
"name": "query-AutomationAction"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where Status != 'Closed'\r\n| where LastModifiedTime != CreatedTime\r\n| where ModifiedBy has_any ('playbook', 'automation rule')\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| summarize Count = count() by Title, bin(TimeGenerated, 1d)",
"size": 0,
"showAnalytics": true,
"title": "Automation Action Count by Incident",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart"
},
"customWidth": "95",
"name": "query-AutomationActionCount"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where LastModifiedTime != CreatedTime\r\n| where ModifiedBy has_any ('playbook', 'automation rule')\r\n| summarize arg_max(TimeGenerated, *) by IncidentName\r\n| extend TimeOpen = datetime_diff('minute', now(), CreatedTime)\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| order by TimeOpen desc\r\n| project IncidentNumber, TimeGenerated, TimeOpen, Title, Description, Severity, Status, ProviderName, ModifiedBy",
"size": 2,
"showAnalytics": true,
"title": "Number of Incidents with Automation Used",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "IncidentNumber",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "14ch"
}
},
{
"columnMatch": "TimeGenerated",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "22ch"
}
},
{
"columnMatch": "TimeOpen",
"formatter": 8,
"formatOptions": {
"min": -2000,
"palette": "lightBlue"
},
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "Title",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "40ch"
}
},
{
"columnMatch": "Description",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "28ch"
}
},
{
"columnMatch": "Severity",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "High",
"representation": "Sev0",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Medium",
"representation": "Sev1",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Low",
"representation": "Sev2",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Informational",
"representation": "Sev3",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": null,
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "14ch"
}
},
{
"columnMatch": "Status",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "New",
"representation": "Sev4",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Active",
"representation": "uninitialized",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Closed",
"representation": "success",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "13ch"
}
},
{
"columnMatch": "ModifiedBy",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "40ch"
}
}
],
"rowLimit": 10000,
"filter": true,
"labelSettings": [
{
"columnId": "IncidentNumber",
"label": "IncidentID"
}
]
}
},
"name": "query-AutomationUsed"
}
]
},
"customWidth": "70",
"name": "Content"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Number of Incidents with Automation\r\nIdentify which incidents are being acted on by automation and review incident performance. Important questions to ask:\r\n- How many incidents are being worked on by automation?\r\n- How long are these incidents open?\r\n- Is automation assisting in incident management efficiency?\r\n\r\nThe current posture check is checking to make sure that X incidents are being acted on by automation. Utilizing automation on incident can drive better SOC efficiency with incidents by eliminating or cutting down on time for manual, human processes. For more information on automation within Microsoft Sentinel, please see [here](https://learn.microsoft.com/azure/sentinel/automation).\r\n\r\nIf looking to deploy automation, check out the templates provided within Microsoft Sentinel in the Automation blade. A button below to the blade is provided.",
"style": "upsell"
},
"name": "text-AutomationUsed"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "paragraph",
"links": [
{
"id": "82cf504f-b72f-4b56-bd81-fff901b2c6de",
"linkTarget": "OpenBlade",
"linkLabel": "Open Automation Blade",
"style": "primary",
"bladeOpenContext": {
"bladeName": "AutomationBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": [
{
"name": "subscription",
"source": "static",
"value": "{Workspace:subscriptionId}"
},
{
"name": "resourceGroup",
"source": "static",
"value": "{Workspace:resourceGroup}"
},
{
"name": "workspace",
"source": "static",
"value": "{Workspace:name}"
}
]
}
}
]
},
"name": "links-AutomationUsed"
}
]
},
"customWidth": "30",
"name": "groupInsights-AutomationUsed"
}
]
},
"name": "AutomationUsed",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Number of Incidents without Automation Used",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where Status != 'Closed'\r\n| where LastModifiedTime != CreatedTime\r\n| where ModifiedBy !has 'playbook' and ModifiedBy !has 'automation rule'\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| summarize Count = count() by IncidentNumber, bin(TimeGenerated, 1d)\r\n| project-away IncidentNumber\r\n",
"size": 0,
"showAnalytics": true,
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart"
},
"customWidth": "80",
"name": "query - 8 - Copy"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "let TCount = (SecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentName\r\n| summarize TCount = count());\r\nlet WCount = (SecurityIncident\r\n| where LastModifiedTime != CreatedTime\r\n| where ModifiedBy has_any ('playbook', 'automation rule')\r\n| summarize arg_max(TimeGenerated, *) by IncidentName\r\n| summarize WCount = count());\r\nlet Percent = (WIncident:double, Total:double) {\r\n print WOCount = (Total-WIncident)\r\n | extend Percentage = (WOCount/Total) * 100\r\n | project Percentage\r\n};\r\nPercent(toscalar(WCount),toscalar(TCount))",
"size": 0,
"title": "Percentage of Incidents without Automation",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"gridSettings": {
"formatters": [
{
"columnMatch": "Percentage",
"formatter": 0,
"numberFormat": {
"unit": 1,
"options": {
"style": "decimal"
}
}
}
]
},
"tileSettings": {
"titleContent": {},
"leftContent": {
"columnMatch": "Percentage",
"formatter": 12,
"formatOptions": {
"palette": "blue"
},
"numberFormat": {
"unit": 1,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
"showBorder": false
},
"textSettings": {
"style": "bignumber"
}
},
"customWidth": "20",
"name": "query-PercentIncidentWithoutAutomation"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where Status != 'Closed'\r\n| where LastModifiedTime != CreatedTime\r\n| where ModifiedBy !has 'playbook' and ModifiedBy !has 'automation rule'\r\n| extend TimeOpen = datetime_diff('minute', now(), CreatedTime)\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| project IncidentNumber, TimeGenerated, TimeOpen, Title, Description, Severity, Status\r\n| order by TimeOpen desc\r\n",
"size": 2,
"showAnalytics": true,
"title": "Incidents without Automation Used",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "IncidentNumber",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "14ch"
}
},
{
"columnMatch": "TimeGenerated",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "22ch"
}
},
{
"columnMatch": "TimeOpen",
"formatter": 8,
"formatOptions": {
"min": -20000,
"palette": "blue"
},
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal",
"minimumFractionDigits": 2
}
}
},
{
"columnMatch": "Title",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "40ch"
}
},
{
"columnMatch": "Description",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "28ch"
}
},
{
"columnMatch": "Severity",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "High",
"representation": "Sev0",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Medium",
"representation": "Sev1",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Low",
"representation": "Sev2",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Informational",
"representation": "Sev3",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "14ch"
}
},
{
"columnMatch": "Status",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "New",
"representation": "Sev4",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Active",
"representation": "uninitialized",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Close",
"representation": "success",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "13ch"
}
}
],
"rowLimit": 10000,
"filter": true,
"labelSettings": [
{
"columnId": "IncidentNumber",
"label": "IncidentID"
}
]
}
},
"name": "query-IncidentWithoutAutomation"
}
]
},
"customWidth": "70",
"name": "Content"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Number of Incidents without Automation\r\nIdentify which incidents are not being acted on by automation and review incident performance. Important questions to ask:\r\n- How many incidents are not being worked on by automation?\r\n- How long are these incidents open?\r\n- Are there any processes that are being repeated for each incident that can be automated?\r\n\r\nThe current posture check is checking to make sure that X incidents are not being acted on by automation. Utilizing automation on incident can drive better SOC efficiency with incidents by eliminating or cutting down on time for manual, human processes. For more information on automation within Microsoft Sentinel, please see [here](https://learn.microsoft.com/azure/sentinel/automation).\r\n\r\nIf looking to deploy automation, check out the templates provided within Microsoft Sentinel in the Automation blade. A button below to the blade is provided.",
"style": "upsell"
},
"name": "text - 1"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "paragraph",
"links": [
{
"id": "82cf504f-b72f-4b56-bd81-fff901b2c6de",
"linkTarget": "OpenBlade",
"linkLabel": "Open Automation Blade",
"style": "primary",
"bladeOpenContext": {
"bladeName": "AutomationBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": [
{
"name": "subscription",
"source": "static",
"value": "{Workspace:subscriptionId}"
},
{
"name": "resourceGroup",
"source": "static",
"value": "{Workspace:resourceGroup}"
},
{
"name": "workspace",
"source": "static",
"value": "{Workspace:name}"
}
]
}
}
]
},
"name": "links - 1"
}
]
},
"customWidth": "30",
"name": "Text"
}
]
},
"name": "AutomationNotUsed",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Mean Time to Respond with Automation",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where ModifiedBy has_any('playbook', 'automation rule')\r\n| where Status == 'Closed'\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber \r\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\r\n| summarize avg(TimeToClosure) by endofday(TimeGenerated), bin(TimeGenerated, 1d)",
"size": 0,
"showAnalytics": true,
"title": "Total Mean Time to Response with Automation, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart",
"chartSettings": {
"ySettings": {
"numberFormatSettings": {
"unit": 25,
"options": {
"style": "decimal",
"useGrouping": true,
"maximumFractionDigits": 2
}
}
}
}
},
"customWidth": "95",
"name": "query-MTTR-Automation"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where ModifiedBy has_any('playbook', 'automation rule')\r\n| where Status == 'Closed'\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber \r\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\r\n| summarize avg(TimeToClosure) by Title, bin(TimeGenerated, 1d)",
"size": 0,
"showAnalytics": true,
"title": "Mean Time to Response with Automation by Incident Name, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart",
"chartSettings": {
"ySettings": {
"numberFormatSettings": {
"unit": 25,
"options": {
"style": "decimal",
"useGrouping": true,
"maximumFractionDigits": 2
}
}
}
}
},
"customWidth": "95",
"name": "query-MTTR-IncidentAutomation"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where ModifiedBy has_any('playbook', 'automation rule')\r\n| where Status == 'Closed'\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber \r\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\r\n| project IncidentNumber, TimeGenerated, TimeToClosure , Title, Description, Severity, Status, Classification, ClassificationComment\r\n| order by TimeToClosure desc",
"size": 2,
"showAnalytics": true,
"title": "Mean Time to Response with Automation, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "IncidentNumber",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "14ch"
}
},
{
"columnMatch": "TimeGenerated",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "22ch"
}
},
{
"columnMatch": "TimeToClosure",
"formatter": 8,
"formatOptions": {
"min": 0,
"palette": "turquoise",
"customColumnWidthSetting": "18ch"
},
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "Title",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "40ch"
}
},
{
"columnMatch": "Description",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "27ch"
}
},
{
"columnMatch": "Severity",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "High",
"representation": "Sev0",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Medium",
"representation": "Sev1",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Low",
"representation": "Sev2",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Informational",
"representation": "Sev3",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "14ch"
}
},
{
"columnMatch": "Status",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "New",
"representation": "Sev4",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Active",
"representation": "pending",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Closed",
"representation": "success",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "12ch"
}
}
],
"rowLimit": 10000,
"filter": true,
"labelSettings": [
{
"columnId": "IncidentNumber",
"label": "IncidentID"
}
]
}
},
"customWidth": "95",
"name": "MTTR"
}
]
},
"customWidth": "70",
"name": "Content"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Mean Time to Respond with Automation\r\n\r\nThe visualizations on the left provide MTTR for incidents which are closed using Playbooks.\r\n\r\nIdentify which incidents are being handled with automation vs. which ones are not being worked on as efficiently. Important questions to ask:\r\n- How many incidents are attached to a playbook?\r\n- Is there evidence that playbooks are driving incident efficiency?\r\n- Are there any areas of improvement with automation?\r\n\r\nThe current posture check is checking to make sure that at least 10 incidents are being acted on via automation. This can be at incident creation time, at closure time, or ad-hoc while analytsts are investigating.\r\n\r\nUtilizing automation on incident can drive better SOC efficiency with incidents by performing any initial triaging processes, queries, and true positive confirmation. For more information on triaging within Microsoft Sentinel, please see:\r\n- [Incident Handling](https://learn.microsoft.com/en-us/azure/sentinel/incident-investigation)\r\n- [Workbooks](https://learn.microsoft.com/en-us/azure/sentinel/monitor-your-data)\r\n- [Automation](https://learn.microsoft.com/en-us/azure/sentinel/sentinel-soar-content)\r\n\r\nIf looking to deploy automation or Workbooks, check out the templates provided within Microsoft Sentinel in the Automation blade or Workbooks blade. A button for both below to the blade is provided.",
"style": "upsell"
},
"name": "text-Insights-MTTR"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "paragraph",
"links": [
{
"id": "82cf504f-b72f-4b56-bd81-fff901b2c6de",
"linkTarget": "OpenBlade",
"linkLabel": "Open Automation Blade",
"style": "primary",
"bladeOpenContext": {
"bladeName": "AutomationBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": [
{
"name": "subscription",
"source": "static",
"value": "{Workspace:subscriptionId}"
},
{
"name": "resourceGroup",
"source": "static",
"value": "{Workspace:resourceGroup}"
},
{
"name": "workspace",
"source": "static",
"value": "{Workspace:name}"
}
]
}
},
{
"id": "3e97d17b-ae77-4b63-8834-bdca0fbdbf11",
"linkTarget": "OpenBlade",
"linkLabel": "Open Workbooks Blade",
"style": "primary",
"bladeOpenContext": {
"bladeName": "WorkbooksBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": [
{
"name": "subscriptionId",
"source": "static",
"value": "{Workspace:subscriptionId}"
},
{
"name": "resourceGroup",
"source": "static",
"value": "{Workspace:resourceGroup}"
},
{
"name": "workspaceName",
"source": "static",
"value": "{Workspace:name}"
}
]
}
}
]
},
"name": "links - 1"
}
]
},
"customWidth": "30",
"name": "Text"
}
]
},
"name": "MTTRA",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Average Time to Acknowledge",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where ModifiedBy !has 'playbook' and ModifiedBy !has 'automation rule'\r\n| summarize arg_max(LastModifiedTime,*) by IncidentNumber\r\n| extend TimeToAcknowledge = (FirstModifiedTime - CreatedTime)/1h\r\n| summarize avg(TimeToAcknowledge) by endofday(TimeGenerated), bin(TimeGenerated, 1d)",
"size": 0,
"showAnalytics": true,
"title": "Average Time to Acknowledge Over Time, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart",
"chartSettings": {
"ySettings": {
"numberFormatSettings": {
"unit": 25,
"options": {
"style": "decimal",
"useGrouping": true,
"maximumFractionDigits": 2
}
}
}
}
},
"customWidth": "95",
"name": "query-AverageTimetoAcknowledge"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where ModifiedBy !has 'playbook' and ModifiedBy !has 'automation rule'\r\n| summarize arg_max(LastModifiedTime,*) by IncidentNumber \r\n| extend TimeToAcknowledge = (FirstModifiedTime - CreatedTime)/1h\r\n| summarize avg(TimeToAcknowledge) by Title",
"size": 2,
"showAnalytics": true,
"title": "Total Time to Acknowledge by Incident Name, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "barchart",
"chartSettings": {
"ySettings": {
"numberFormatSettings": {
"unit": 25,
"options": {
"style": "decimal",
"useGrouping": true,
"maximumFractionDigits": 2
}
}
}
}
},
"customWidth": "95",
"name": "query-ATTATitle"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where ModifiedBy !has 'playbook' and ModifiedBy !has 'automation rule'\r\n| summarize arg_max(LastModifiedTime,*) by IncidentNumber \r\n| extend TimeToAcknowledge = (FirstModifiedTime - CreatedTime)/1h, TimeOpen = datetime_diff('minute', now(), CreatedTime)\r\n| where isempty(TimeToAcknowledge)\r\n| summarize Count = count()\r\n| extend Title = \"Not Acknowledged\"\r\n| extend Text1 = \"{TimeRange:label}\"\r\n| extend Text2 = \"Incident(s)\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"gridSettings": {
"formatters": [
{
"columnMatch": "TimeToAcknowledge",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "is Empty",
"representation": "Blank",
"text": "Not Acknowledged"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "Blank",
"text": "{0}{1}"
}
]
},
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "TimeOpen",
"formatter": 0,
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal"
}
}
}
]
},
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "Count",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "Default",
"thresholdValue": null,
"representation": "3",
"text": "{0}{1}"
}
]
}
},
"rightContent": {
"columnMatch": "Text2",
"formatter": 1
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
},
"textSettings": {
"style": "bignumber"
}
},
"customWidth": "30",
"name": "query-IncNotAck"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where ModifiedBy !has 'playbook' and ModifiedBy !has 'automation rule'\r\n| summarize arg_max(LastModifiedTime,*) by IncidentNumber \r\n| extend TimeToAcknowledge = (FirstModifiedTime - CreatedTime)/1h, TimeOpen = datetime_diff('minute', now(), CreatedTime)\r\n| project IncidentNumber, TimeGenerated, TimeOpen, TimeToAcknowledge, Title, Description, Severity, Status\r\n| order by TimeToAcknowledge desc",
"size": 2,
"showAnalytics": true,
"title": "Time to Acknowledge per Incident, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "IncidentNumber",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "14ch"
}
},
{
"columnMatch": "TimeGenerated",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "22ch"
}
},
{
"columnMatch": "TimeOpen",
"formatter": 8,
"formatOptions": {
"min": -10000,
"palette": "blue"
},
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "TimeToAcknowledge",
"formatter": 8,
"formatOptions": {
"palette": "purpleRed",
"customColumnWidthSetting": "23ch"
},
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "Title",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "40ch"
}
},
{
"columnMatch": "Description",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "28ch"
}
},
{
"columnMatch": "Severity",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "High",
"representation": "Sev0",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Medium",
"representation": "Sev1",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Low",
"representation": "Sev2",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Informational",
"representation": "Sev3",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "14ch"
}
},
{
"columnMatch": "Status",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "New",
"representation": "Sev4",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Active",
"representation": "uninitialized",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Closed",
"representation": "success",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "12ch"
}
}
],
"rowLimit": 10000,
"filter": true,
"labelSettings": [
{
"columnId": "IncidentNumber",
"label": "IncidentID"
}
]
}
},
"customWidth": "95",
"name": "Average Time to Acknowledge"
}
]
},
"customWidth": "70",
"name": "Content"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Average Time to Acknowledge\r\nIdentify which incidents are being properly acknowledged vs. which ones are not acknowledged at all. Important questions to ask:\r\n- How many incidents are being acknowledged within a timely manner?\r\n- Are there any trends in incidents that are not properly acknowledged?\r\n- Are there tools that can assist with traiging? (Workbooks, automation rules, playbooks)\r\n\r\nThe current posture check is checking to make sure that incidents are being acknowledged within 5 hours of its creation. Triaging within Microsoft Sentinel can take place within the incidents blade, via API, or via automation.\r\n\r\nUtilizing automation on incident can drive better SOC efficiency with incidents by performing any initial triaging processes, queries, and true positive confirmation. For more information on triaging within Microsoft Sentinel, please see:\r\n- [Incident Handling](https://learn.microsoft.com/en-us/azure/sentinel/incident-investigation)\r\n- [Workbooks](https://learn.microsoft.com/en-us/azure/sentinel/monitor-your-data)\r\n- [Automation](https://learn.microsoft.com/en-us/azure/sentinel/sentinel-soar-content)\r\n\r\nIf looking to deploy automation or Workbooks, check out the templates provided within Microsoft Sentinel in the Automation blade or Workbooks blade. A button for both below to the blade is provided.",
"style": "upsell"
},
"name": "text-Insights-ATTA"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "paragraph",
"links": [
{
"id": "82cf504f-b72f-4b56-bd81-fff901b2c6de",
"linkTarget": "OpenBlade",
"linkLabel": "Open Automation Blade",
"style": "primary",
"bladeOpenContext": {
"bladeName": "AutomationBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": [
{
"name": "subscription",
"source": "static",
"value": "{Workspace:subscriptionId}"
},
{
"name": "resourceGroup",
"source": "static",
"value": "{Workspace:resourceGroup}"
},
{
"name": "workspace",
"source": "static",
"value": "{Workspace:name}"
}
]
}
},
{
"id": "3e97d17b-ae77-4b63-8834-bdca0fbdbf11",
"linkTarget": "OpenBlade",
"linkLabel": "Open Workbooks Blade",
"style": "primary",
"bladeOpenContext": {
"bladeName": "WorkbooksBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": [
{
"name": "subscriptionId",
"source": "static",
"value": "{Workspace:subscriptionId}"
},
{
"name": "resourceGroup",
"source": "static",
"value": "{Workspace:resourceGroup}"
},
{
"name": "workspaceName",
"source": "static",
"value": "{Workspace:name}"
}
]
}
}
]
},
"name": "links-Automation-ATTA"
}
]
},
"customWidth": "30",
"name": "Text"
}
]
},
"name": "ATTA",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Average Time to Closure",
"expandable": true,
"items": [
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "tabs",
"tabStyle": "bigger",
"links": [
{
"id": "08f9f6f6-0b30-46ea-8a0c-84593eff4678",
"cellValue": "Subtab",
"linkTarget": "parameter",
"linkLabel": "User",
"subTarget": "User",
"style": "link",
"tabWidth": "400px"
},
{
"id": "322d3090-fb38-4bf1-8422-c7d28d5d73e6",
"cellValue": "Subtab",
"linkTarget": "parameter",
"linkLabel": "Automation",
"subTarget": "Automation",
"style": "link",
"tabWidth": "400px"
}
]
},
"name": "links - 3"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber\r\n| where Status == 'Closed'\r\n| where ModifiedBy !has 'playbook'\r\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\r\n| summarize avg(TimeToClosure) by endofday(TimeGenerated), bin(TimeGenerated, 1d)",
"size": 0,
"showAnalytics": true,
"title": "Total Average Time to Closure, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart",
"chartSettings": {
"ySettings": {
"numberFormatSettings": {
"unit": 25,
"options": {
"style": "decimal",
"useGrouping": true,
"maximumFractionDigits": 2
}
}
}
}
},
"customWidth": "95",
"name": "query-ATTCAvg"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber\r\n| where Status == 'Closed'\r\n| where ModifiedBy !has 'playbook'\r\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\r\n| summarize avg(TimeToClosure) by Title, bin(TimeGenerated, 1d)",
"size": 0,
"showAnalytics": true,
"title": "Time to Closure Per Incident Name, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart",
"chartSettings": {
"ySettings": {
"numberFormatSettings": {
"unit": 25,
"options": {
"style": "decimal",
"useGrouping": true,
"maximumFractionDigits": 2
}
}
}
}
},
"customWidth": "95",
"name": "query-ATTCInc"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber\r\n| where Status == 'Closed'\r\n| where ModifiedBy !has 'playbook'\r\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\r\n| summarize Average = avg(TimeToClosure)\r\n| extend Title = \"Avg Time to Closure\"\r\n| extend Text1 = \"{TimeRange:label}\"\r\n",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"gridSettings": {
"formatters": [
{
"columnMatch": "Average",
"formatter": 0,
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal"
}
}
}
]
},
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "Average",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "blue"
},
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-AvgTimeClosure"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber\r\n| where Status == 'Closed'\r\n| where ModifiedBy !has 'playbook'\r\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\r\n| project IncidentNumber, TimeGenerated, TimeToClosure, Title, Description, Severity, Status\r\n| order by TimeToClosure desc",
"size": 2,
"showAnalytics": true,
"title": "Average Time to Closure, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "IncidentNumber",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "14ch"
}
},
{
"columnMatch": "TimeGenerated",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "22ch"
}
},
{
"columnMatch": "TimeToClosure",
"formatter": 8,
"formatOptions": {
"min": -1000,
"palette": "magenta",
"customColumnWidthSetting": "18ch"
},
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "Title",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "40ch"
}
},
{
"columnMatch": "Description",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "28ch"
}
},
{
"columnMatch": "Severity",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "High",
"representation": "Sev0",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Medium",
"representation": "Sev1",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Low",
"representation": "Sev2",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Informational",
"representation": "Sev3",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "15ch"
}
},
{
"columnMatch": "Status",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "New",
"representation": "Sev4",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Active",
"representation": "uninitialized",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Closed",
"representation": "success",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "12ch"
}
},
{
"columnMatch": "TimeOpen",
"formatter": 0,
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal"
}
}
}
],
"rowLimit": 10000,
"filter": true,
"labelSettings": [
{
"columnId": "IncidentNumber",
"label": "IncidentID"
}
]
}
},
"name": "Time to Closure"
}
]
},
"customWidth": "70",
"conditionalVisibility": {
"parameterName": "Subtab",
"comparison": "isEqualTo",
"value": "User"
},
"name": "Content - Human"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber\r\n| where Status == 'Closed'\r\n| where ModifiedBy has_any ('playbook', 'automation rule')\r\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\r\n| summarize avg(TimeToClosure) by endofday(TimeGenerated), bin(TimeGenerated, 1d)",
"size": 0,
"showAnalytics": true,
"title": "Total Average Time to Closure, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart",
"chartSettings": {
"ySettings": {
"numberFormatSettings": {
"unit": 25,
"options": {
"style": "decimal",
"useGrouping": true,
"maximumFractionDigits": 2
}
}
}
}
},
"customWidth": "95",
"name": "query-ATTCAvg"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber\r\n| where Status == 'Closed'\r\n| where ModifiedBy has_any ('playbook', 'automation rule')\r\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\r\n| summarize avg(TimeToClosure) by Title, bin(TimeGenerated, 1d)",
"size": 0,
"showAnalytics": true,
"title": "Time to Closure Per Incident Name, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart",
"chartSettings": {
"ySettings": {
"numberFormatSettings": {
"unit": 25,
"options": {
"style": "decimal",
"useGrouping": true,
"maximumFractionDigits": 2
}
}
}
}
},
"customWidth": "95",
"name": "query-ATTCInc"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber\r\n| where Status == 'Closed'\r\n| where ModifiedBy has_any ('playbook', 'automation rule')\r\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\r\n| summarize Average = avg(TimeToClosure)\r\n| extend Title = \"Avg Time to Closure\"\r\n| extend Text1 = \"{TimeRange:label}\"\r\n",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"gridSettings": {
"formatters": [
{
"columnMatch": "Average",
"formatter": 0,
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal"
}
}
}
]
},
"tileSettings": {
"titleContent": {
"columnMatch": "Title"
},
"leftContent": {
"columnMatch": "Average",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "blue"
},
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "25",
"name": "query-AvgTimeClosure"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber\r\n| where Status == 'Closed'\r\n| where ModifiedBy has_any ('playbook', 'automation rule')\r\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\r\n| project IncidentNumber, TimeGenerated, TimeToClosure, Title, Description, Severity, Status\r\n| order by TimeToClosure desc",
"size": 0,
"showAnalytics": true,
"title": "Average Time to Closure, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "IncidentNumber",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "14ch"
}
},
{
"columnMatch": "TimeGenerated",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "22ch"
}
},
{
"columnMatch": "TimeToClosure",
"formatter": 8,
"formatOptions": {
"min": -1000,
"palette": "magenta",
"customColumnWidthSetting": "18ch"
},
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "Title",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "40ch"
}
},
{
"columnMatch": "Description",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "28ch"
}
},
{
"columnMatch": "Severity",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "High",
"representation": "Sev0",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Medium",
"representation": "Sev1",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Low",
"representation": "Sev2",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Informational",
"representation": "Sev3",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "15ch"
}
},
{
"columnMatch": "Status",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "New",
"representation": "Sev4",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Active",
"representation": "uninitialized",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Closed",
"representation": "success",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "12ch"
}
},
{
"columnMatch": "TimeOpen",
"formatter": 0,
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal"
}
}
}
],
"filter": true,
"labelSettings": [
{
"columnId": "IncidentNumber",
"label": "IncidentID"
}
]
}
},
"name": "Time to Closure"
}
]
},
"customWidth": "70",
"conditionalVisibility": {
"parameterName": "Subtab",
"comparison": "isEqualTo",
"value": "Automation"
},
"name": "Content - Automation"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Average Time to Closure\r\nIdentify which incidents are being properly worked on to completion vs. which ones have slipped. Important questions to ask:\r\n- Are incidents being closed in a proper timeframe?\r\n- Are there any trends in incidents that are not properly being closed?\r\n- Are there tools that can assist with investigating and closing incidents? (Workbooks, automation rules, playbooks)\r\n\r\nThe current posture check is checking to make sure that incidents are being closed within 5 hours of its creation. Investigating and closing incidents within Microsoft Sentinel can take place within the incidents blade, workbooks, playbooks, or the M365D portal.\r\n\r\nUtilizing automation on incident can drive better SOC efficiency with incidents by performing any initial triaging processes, queries, and true positive confirmation. For more information on triaging within Microsoft Sentinel, please see:\r\n- [Incident Handling](https://learn.microsoft.com/en-us/azure/sentinel/incident-investigation)\r\n- [Workbooks](https://learn.microsoft.com/en-us/azure/sentinel/monitor-your-data)\r\n- [Automation](https://learn.microsoft.com/en-us/azure/sentinel/sentinel-soar-content)\r\n\r\nIf looking to deploy automation or Workbooks, check out the templates provided within Microsoft Sentinel in the Automation blade or Workbooks blade. A button for both below to the blade is provided.",
"style": "upsell"
},
"name": "text-Insights-ATTC"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "paragraph",
"links": [
{
"id": "82cf504f-b72f-4b56-bd81-fff901b2c6de",
"linkTarget": "OpenBlade",
"linkLabel": "Open Automation Blade",
"style": "primary",
"bladeOpenContext": {
"bladeName": "AutomationBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": [
{
"name": "subscription",
"source": "static",
"value": "{Workspace:subscriptionId}"
},
{
"name": "resourceGroup",
"source": "static",
"value": "{Workspace:resourceGroup}"
},
{
"name": "workspace",
"source": "static",
"value": "{Workspace:name}"
}
]
}
},
{
"id": "3e97d17b-ae77-4b63-8834-bdca0fbdbf11",
"linkTarget": "OpenBlade",
"linkLabel": "Open Workbooks Blade",
"style": "primary",
"bladeOpenContext": {
"bladeName": "WorkbooksBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": [
{
"name": "subscriptionId",
"source": "static",
"value": "{Workspace:subscriptionId}"
},
{
"name": "resourceGroup",
"source": "static",
"value": "{Workspace:resourceGroup}"
},
{
"name": "workspaceName",
"source": "static",
"value": "{Workspace:name}"
}
]
}
}
]
},
"name": "links-Automation-ATTC"
}
]
},
"customWidth": "30",
"name": "Text"
}
]
},
"name": "ATTC",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Mean Time to Respond without Automation",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where Status == 'Closed'\r\n| where ModifiedBy !has 'playbook'\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber \r\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\r\n| summarize avg(TimeToClosure) by endofday(TimeGenerated), bin(TimeGenerated, 1d)",
"size": 0,
"showAnalytics": true,
"title": "Mean TIme to Respond without Automation, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart",
"gridSettings": {
"formatters": [
{
"columnMatch": "TimeToClosure",
"formatter": 0,
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal"
}
}
}
]
},
"chartSettings": {
"ySettings": {
"numberFormatSettings": {
"unit": 25,
"options": {
"style": "decimal",
"useGrouping": true
}
}
}
}
},
"customWidth": "95",
"name": "MTTR without Automation"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where Status == 'Closed'\r\n| where ModifiedBy !has 'playbook'\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber \r\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\r\n| summarize avg(TimeToClosure) by Title, bin(TimeGenerated, 1d)\r\n",
"size": 0,
"showAnalytics": true,
"title": "Mean TIme to Respond without Automation, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart",
"gridSettings": {
"formatters": [
{
"columnMatch": "TimeToClosure",
"formatter": 0,
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal"
}
}
}
]
},
"chartSettings": {
"ySettings": {
"numberFormatSettings": {
"unit": 25,
"options": {
"style": "decimal",
"useGrouping": true
}
}
}
}
},
"customWidth": "95",
"name": "query-MTTR without Automation"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where Status == 'Closed'\r\n| where ModifiedBy !has 'playbook'\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber \r\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\r\n| project IncidentNumber, TimeGenerated, TimeToClosure, Title, Description, Severity, Status, Classification\r\n| order by TimeToClosure desc",
"size": 2,
"showAnalytics": true,
"title": "Mean Time to Respond without Automation, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "IncidentNumber",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "14ch"
}
},
{
"columnMatch": "TimeGenerated",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "22ch"
}
},
{
"columnMatch": "TimeToClosure",
"formatter": 8,
"formatOptions": {
"min": -1000,
"palette": "turquoise",
"customColumnWidthSetting": "18ch"
},
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "Title",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "40ch"
}
},
{
"columnMatch": "Description",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "27ch"
}
},
{
"columnMatch": "Severity",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "High",
"representation": "Sev0",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Medium",
"representation": "Sev1",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Low",
"representation": "Sev2",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Informational",
"representation": "Sev3",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "14ch"
}
},
{
"columnMatch": "Status",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "New",
"representation": "Sev4",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Active",
"representation": "uninitialized",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Closed",
"representation": "success",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
]
}
}
],
"rowLimit": 10000,
"filter": true,
"labelSettings": [
{
"columnId": "IncidentNumber",
"label": "IncidentID"
}
]
}
},
"customWidth": "95",
"name": "queryMTTR without Automation-Table"
}
]
},
"customWidth": "70",
"name": "Content"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Mean Time to Respond without Automation\r\nIdentify which incidents are being handled with automation vs. which ones are not being worked on as efficiently. Important questions to ask:\r\n- How many incidents are not attached to a playbook?\r\n- Is there evidence that incidents are not being closed efficiently without automation?\r\n- Are there trends in incidents without autoamtion and high time to respond?\r\n\r\nThe current posture check is checking to make sure that at least 10 incidents are being acted on via automation. This can be at incident creation time, at closure time, or ad-hoc while analytsts are investigating.\r\n\r\nUtilizing automation on incident can drive better SOC efficiency with incidents by performing any initial triaging processes, queries, and true positive confirmation. For more information on triaging within Microsoft Sentinel, please see:\r\n- [Incident Handling](https://learn.microsoft.com/en-us/azure/sentinel/incident-investigation)\r\n- [Workbooks](https://learn.microsoft.com/en-us/azure/sentinel/monitor-your-data)\r\n- [Automation](https://learn.microsoft.com/en-us/azure/sentinel/sentinel-soar-content)\r\n\r\nIf looking to deploy automation or Workbooks, check out the templates provided within Microsoft Sentinel in the Automation blade or Workbooks blade. A button for both below to the blade is provided.",
"style": "upsell"
},
"name": "text - 1"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "paragraph",
"links": [
{
"id": "82cf504f-b72f-4b56-bd81-fff901b2c6de",
"linkTarget": "OpenBlade",
"linkLabel": "Open Automation Blade",
"style": "primary",
"bladeOpenContext": {
"bladeName": "AutomationBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": [
{
"name": "subscription",
"source": "static",
"value": "{Workspace:subscriptionId}"
},
{
"name": "resourceGroup",
"source": "static",
"value": "{Workspace:resourceGroup}"
},
{
"name": "workspace",
"source": "static",
"value": "{Workspace:name}"
}
]
}
},
{
"id": "3e97d17b-ae77-4b63-8834-bdca0fbdbf11",
"linkTarget": "OpenBlade",
"linkLabel": "Open Workbooks Blade",
"style": "primary",
"bladeOpenContext": {
"bladeName": "WorkbooksBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": [
{
"name": "subscriptionId",
"source": "static",
"value": "{Workspace:subscriptionId}"
},
{
"name": "resourceGroup",
"source": "static",
"value": "{Workspace:resourceGroup}"
},
{
"name": "workspaceName",
"source": "static",
"value": "{Workspace:name}"
}
]
}
}
]
},
"name": "links - 1"
}
]
},
"customWidth": "30",
"name": "Text"
}
]
},
"name": "MTTRNA",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Mean Time to Response with Tasks",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where Status == 'Closed'\r\n| where Tasks != '[]'\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber \r\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\r\n| summarize avg(TimeToClosure) by endofday(TimeGenerated), bin(TimeGenerated, 1d)\r\n",
"size": 0,
"showAnalytics": true,
"title": "Total Mean Time to Respond with Tasks, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart",
"chartSettings": {
"ySettings": {
"numberFormatSettings": {
"unit": 25,
"options": {
"style": "decimal",
"useGrouping": true,
"maximumFractionDigits": 2
}
}
}
}
},
"customWidth": "95",
"name": "query-MTTRWithTasks"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where Status == 'Closed'\r\n| where Tasks != '[]'\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber \r\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\r\n| summarize avg(TimeToClosure) by Title, bin(TimeGenerated, 1d)\r\n",
"size": 0,
"showAnalytics": true,
"title": "Mean Time to Respond with Tasks Per Incident Name, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart",
"chartSettings": {
"ySettings": {
"numberFormatSettings": {
"unit": 25,
"options": {
"style": "decimal",
"useGrouping": true,
"maximumFractionDigits": 2
}
}
}
}
},
"customWidth": "95",
"name": "query-MTTRWithTasksIncident"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where Status == 'Closed'\r\n| where Tasks != '[]'\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber \r\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\r\n| project IncidentNumber, TimeGenerated, TimeToClosure, Title, Description, Status, Classification, ClassificationComment, ClassificationReason",
"size": 2,
"showAnalytics": true,
"title": "MTTR with Tasks, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "IncidentNumber",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "14ch"
}
},
{
"columnMatch": "TimeGenerated",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "22ch"
}
},
{
"columnMatch": "TimeToClosure",
"formatter": 8,
"formatOptions": {
"min": -1000,
"palette": "turquoise",
"customColumnWidthSetting": "18ch"
},
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "Title",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "40ch"
}
},
{
"columnMatch": "Description",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "27ch"
}
},
{
"columnMatch": "Status",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "New",
"representation": "Sev4",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Active",
"representation": "uninitialized",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Closed",
"representation": "success",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
]
}
}
],
"rowLimit": 10000,
"filter": true,
"labelSettings": [
{
"columnId": "IncidentNumber",
"label": "IncidentID"
}
]
}
},
"customWidth": "95",
"name": "MTTR with Tasks"
}
]
},
"customWidth": "70",
"name": "Content"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Mean Time to Repond with Tasks\r\nIdentify which incidents are receiving tasks vs. which ones are not. Important questions to ask:\r\n- If tasks are being created, are they being closed in a timely manner?\r\n- Are tasks driving better closure time for incidents?\r\n- Are there incidents without tasks that could benefit from them?\r\n\r\nThe current posture check is checking to make sure that at least 10 incidents are getting tasks associated with them. Creating tasks for incidents can help drive incident response efficiency, guide analysts through an incident, and improve incident progress tracking.\r\n\r\nUtilizing tasks in incident can drive better SOC efficiency, whether they are manually created or made via automation. \r\n\r\nFor more information, please see [Incident Tasks](https://learn.microsoft.com/en-us/azure/sentinel/incident-tasks)\r\n\r\n",
"style": "upsell"
},
"name": "text - 1"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "paragraph",
"links": [
{
"id": "82cf504f-b72f-4b56-bd81-fff901b2c6de",
"linkTarget": "OpenBlade",
"linkLabel": "Open Automation Blade",
"style": "primary",
"bladeOpenContext": {
"bladeName": "AutomationBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": [
{
"name": "subscription",
"source": "static",
"value": "{Workspace:subscriptionId}"
},
{
"name": "resourceGroup",
"source": "static",
"value": "{Workspace:resourceGroup}"
},
{
"name": "workspace",
"source": "static",
"value": "{Workspace:name}"
}
]
}
},
{
"id": "3e97d17b-ae77-4b63-8834-bdca0fbdbf11",
"linkTarget": "OpenBlade",
"linkLabel": "Open Workbooks Blade",
"style": "primary",
"bladeOpenContext": {
"bladeName": "WorkbooksBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": [
{
"name": "subscriptionId",
"source": "static",
"value": "{Workspace:subscriptionId}"
},
{
"name": "resourceGroup",
"source": "static",
"value": "{Workspace:resourceGroup}"
},
{
"name": "workspaceName",
"source": "static",
"value": "{Workspace:name}"
}
]
}
}
]
},
"name": "links - 1"
}
]
},
"customWidth": "30",
"name": "Text"
}
]
},
"name": "MTTRT",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Highest Mean Time to Respond",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where Status == 'Closed'\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber \r\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\r\n| order by TimeToClosure desc\r\n| top 10 by TimeToClosure\r\n| summarize avg(TimeToClosure) by endofday(TimeGenerated), bin(TimeGenerated, 1d)",
"size": 0,
"showAnalytics": true,
"title": "Collective High MTTR Incidents, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart",
"gridSettings": {
"formatters": [
{
"columnMatch": "TimeToClosure",
"formatter": 0,
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal"
}
}
}
]
},
"chartSettings": {
"ySettings": {
"numberFormatSettings": {
"unit": 25,
"options": {
"style": "decimal",
"useGrouping": true,
"maximumFractionDigits": 2
}
}
}
}
},
"customWidth": "95",
"name": "query-Highest MTTR Incidents"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where Status == 'Closed'\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber \r\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\r\n| order by TimeToClosure desc\r\n| top 10 by TimeToClosure\r\n| summarize avg(TimeToClosure) by Title, bin(TimeGenerated, 1d)",
"size": 0,
"showAnalytics": true,
"title": "Highest MTTR Incidents by Title, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart",
"gridSettings": {
"formatters": [
{
"columnMatch": "TimeToClosure",
"formatter": 0,
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal"
}
}
}
]
},
"chartSettings": {
"ySettings": {
"numberFormatSettings": {
"unit": 25,
"options": {
"style": "decimal",
"useGrouping": true,
"maximumFractionDigits": 2
}
}
}
}
},
"customWidth": "95",
"name": "query-HighestMTTRByIncidents"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where Status == 'Closed'\r\n| summarize arg_max(TimeGenerated,*) by IncidentNumber \r\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\r\n| project IncidentNumber, TimeGenerated, TimeToClosure, Title, Description, Severity, Status, Classification, ClassificationComment\r\n| order by TimeToClosure desc\r\n| top 10 by TimeToClosure",
"size": 2,
"showAnalytics": true,
"title": "Highest MTTR Incidents, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "IncidentNumber",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "14ch"
}
},
{
"columnMatch": "TimeGenerated",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "22ch"
}
},
{
"columnMatch": "TimeToClosure",
"formatter": 8,
"formatOptions": {
"min": -1000,
"palette": "turquoise",
"customColumnWidthSetting": "18ch"
},
"numberFormat": {
"unit": 25,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "Title",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "40ch"
}
},
{
"columnMatch": "Description",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "27ch"
}
},
{
"columnMatch": "Severity",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "High",
"representation": "Sev0",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Medium",
"representation": "Sev1",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Low",
"representation": "Sev2",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Informational",
"representation": "Sev3",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "14ch"
}
},
{
"columnMatch": "Status",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "New",
"representation": "Sev4",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Active",
"representation": "uninitialized",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Closed",
"representation": "success",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "12ch"
}
}
],
"rowLimit": 10000,
"filter": true,
"labelSettings": [
{
"columnId": "IncidentNumber",
"label": "IncidentID"
}
]
}
},
"customWidth": "95",
"name": "Highest MTTR Incidents"
}
]
},
"customWidth": "70",
"name": "Content"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Highest Mean Time to Respond\r\nIdentify which incidents are not being closed within a timely manner. Important questions to reflect on here are:\r\n- Are these incidents missing tasks or automation?\r\n- Is there a trend in title or provider that may be causing the slow response?\r\n- Is there missing context for these incidents that could be brought into Sentinel to drive efficiency (logs, threat intelligence, enrichment, etc)\r\n\r\nUtilizing automation on incident can drive better SOC efficiency with incidents by performing any initial triaging processes, queries, and true positive confirmation. For more information on triaging within Microsoft Sentinel, please see:\r\n- [Incident Handling](https://learn.microsoft.com/en-us/azure/sentinel/incident-investigation)\r\n- [Workbooks](https://learn.microsoft.com/en-us/azure/sentinel/monitor-your-data)\r\n- [Automation](https://learn.microsoft.com/en-us/azure/sentinel/sentinel-soar-content)\r\n\r\nIf looking to deploy automation or Workbooks, check out the templates provided within Microsoft Sentinel in the Automation blade or Workbooks blade. A button for both below to the blade is provided.",
"style": "upsell"
},
"name": "text - 1"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "paragraph",
"links": [
{
"id": "82cf504f-b72f-4b56-bd81-fff901b2c6de",
"linkTarget": "OpenBlade",
"linkLabel": "Open Automation Blade",
"style": "primary",
"bladeOpenContext": {
"bladeName": "AutomationBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": [
{
"name": "subscription",
"source": "static",
"value": "{Workspace:subscriptionId}"
},
{
"name": "resourceGroup",
"source": "static",
"value": "{Workspace:resourceGroup}"
},
{
"name": "workspace",
"source": "static",
"value": "{Workspace:name}"
}
]
}
},
{
"id": "3e97d17b-ae77-4b63-8834-bdca0fbdbf11",
"linkTarget": "OpenBlade",
"linkLabel": "Open Workbooks Blade",
"style": "primary",
"bladeOpenContext": {
"bladeName": "WorkbooksBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": [
{
"name": "subscriptionId",
"source": "static",
"value": "{Workspace:subscriptionId}"
},
{
"name": "resourceGroup",
"source": "static",
"value": "{Workspace:resourceGroup}"
},
{
"name": "workspaceName",
"source": "static",
"value": "{Workspace:name}"
}
]
}
}
]
},
"name": "links - 1"
}
]
},
"customWidth": "30",
"name": "Text"
}
]
},
"name": "MTTRIncidents",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Closing Classifications over Time",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where Status == 'Closed'\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| summarize Count = count() by Classification, bin (TimeGenerated, 1d)",
"size": 0,
"showAnalytics": true,
"title": "Incident Closing Classification by Category, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart"
},
"customWidth": "95",
"name": "query-IncidentClassification"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where Status == 'Closed'\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| summarize Count = count() by Title, bin (TimeGenerated, 1d)",
"size": 0,
"showAnalytics": true,
"title": "Incident Closing Classification by Title, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart"
},
"customWidth": "95",
"name": "query-IncidentByClosingClassification"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where Status == 'Closed'\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| summarize Count = count() by Classification, Title, ProviderName, bin (TimeGenerated, 1d)\r\n| evaluate pivot(Classification, count(), Title, TimeGenerated)\r\n| order by TimeGenerated desc",
"size": 2,
"showAnalytics": true,
"title": "Closing Classification over Time, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Count",
"formatter": 8,
"formatOptions": {
"min": -100,
"palette": "blue"
}
}
],
"rowLimit": 10000,
"filter": true
}
},
"customWidth": "95",
"name": "Closing Classification"
}
]
},
"customWidth": "70",
"name": "Content"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Closing Classification over Time\r\nIdentify how many incidents have been closed and which classifcation is being used most for the closing classification. This data is important to monitor as it not only shows how many incidents are being closed but also which classifcation is being used when they are closed.\r\n\r\nHigh counts of undetermined classifcations can reflect a lack of useful data or insights into threats and compromises that have occurred. High counts of false positives can reflect bad configurations in detections and a need for fine tuning. High counts of true positive can reflect detection accuracy but also an unwanted frequency in real threats occuring. \r\n\r\n[Microsoft Sentinel Analytic Rules](https://learn.microsoft.com/en-us/azure/sentinel/tutorial-log4j-detection) \r\n[Defender for Cloud Detections](https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference) \r\n[Microsoft 365 Defender Connector](https://learn.microsoft.com/en-us/azure/sentinel/microsoft-365-defender-sentinel-integration) \r\n",
"style": "upsell"
},
"name": "text - 1"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "list",
"links": [
{
"id": "cac11e31-4e5a-4b86-adcf-9ab9bb861b29",
"linkTarget": "OpenBlade",
"linkLabel": "Open Incidents Blade",
"style": "primary",
"bladeOpenContext": {
"bladeName": "CasesBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeJsonParameters": "{\r\n \"crossWorkspaceMode\": false\r\n}"
}
}
]
},
"name": "links - 1"
}
]
},
"customWidth": "30",
"name": "Text"
}
]
},
"name": "CC",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Alerts Over Time per Severity",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityAlert\r\n| summarize arg_max(TimeGenerated, *) by SystemAlertId\r\n| summarize Count = count() by AlertSeverity, bin(TimeGenerated, 1d)",
"size": 0,
"showAnalytics": true,
"title": "Alert Count per Severity, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart"
},
"customWidth": "95",
"name": "query-AlertCount"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityAlert\r\n| summarize arg_max(TimeGenerated, *) by SystemAlertId\r\n| summarize Count = count() by ProviderName, AlertSeverity, bin(TimeGenerated, 1d)",
"size": 0,
"showAnalytics": true,
"title": "Alert Count per Provider, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart"
},
"customWidth": "95",
"name": "query-AlertByProvider"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityAlert | summarize arg_max(TimeGenerated, *) by SystemAlertId | summarize by ProviderName, AlertSeverity, bin(TimeGenerated, 1d), SystemAlertId | evaluate pivot(AlertSeverity, count(), ProviderName, TimeGenerated) | order by TimeGenerated desc | project-reorder ProviderName, TimeGenerated, High, Medium, Low, Informational",
"size": 0,
"showAnalytics": true,
"title": "Alerts Over Time per Severity, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "High",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "Default",
"thresholdValue": null,
"representation": "Sev0",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Medium",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "Default",
"thresholdValue": null,
"representation": "Sev1",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Low",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "Default",
"thresholdValue": null,
"representation": "Sev2",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Informational",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "Default",
"thresholdValue": null,
"representation": "Sev3",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "AlertSeverity",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "High",
"representation": "Sev0",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Medium",
"representation": "Sev1",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Low",
"representation": "Sev2",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Informational",
"representation": "Sev3",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Count",
"formatter": 8,
"formatOptions": {
"min": -100,
"palette": "blue"
}
}
],
"rowLimit": 10000,
"filter": true
}
},
"name": "query-Alerts Over Time per Severity"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityAlert \r\n| extend Tactics = split(Tactics, \",\")\r\n| extend Tactics = replace_string(tostring(Tactics), \" \", \"\")\r\n| mvexpand todynamic(Tactics)\r\n| summarize arg_max(TimeGenerated, *) by SystemAlertId | summarize by tostring(Tactics), AlertSeverity, bin(TimeGenerated, 1d), SystemAlertId | evaluate pivot(AlertSeverity, count(),Tactics , TimeGenerated) | order by TimeGenerated desc | project-reorder Tactics, TimeGenerated, High, Medium, Low, Informational",
"size": 0,
"showAnalytics": true,
"title": "Alerts Over Time per Severity, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "High",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "Default",
"thresholdValue": null,
"representation": "Sev0",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Medium",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "Default",
"thresholdValue": null,
"representation": "Sev1",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Low",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "Default",
"thresholdValue": null,
"representation": "Sev2",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Informational",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "Default",
"thresholdValue": null,
"representation": "Sev3",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "AlertSeverity",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "High",
"representation": "Sev0",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Medium",
"representation": "Sev1",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Low",
"representation": "Sev2",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Informational",
"representation": "Sev3",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Count",
"formatter": 8,
"formatOptions": {
"min": -100,
"palette": "blue"
}
}
],
"rowLimit": 10000,
"filter": true
}
},
"name": "query-Alerts Over Time per Severity - Copy"
}
]
},
"customWidth": "70",
"name": "Content"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Alerts by Severity\r\nIdentify how many alerts are being generated per severity and by which product. These stats are good to monitor in order to find where the threats are occuring the most and to what level. This can assist in finding weak spots within the environment or common causes for these alerts. \r\n\r\n[Microsoft Sentinel Analytic Rules](https://learn.microsoft.com/en-us/azure/sentinel/tutorial-log4j-detection) \r\n[Defender for Cloud Detections](https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference) \r\n[Microsoft 365 Defender Connector](https://learn.microsoft.com/en-us/azure/sentinel/microsoft-365-defender-sentinel-integration) \r\n",
"style": "upsell"
},
"name": "text - 1"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "list",
"links": [
{
"id": "cac11e31-4e5a-4b86-adcf-9ab9bb861b29",
"linkTarget": "OpenBlade",
"linkLabel": "Open Incidents Blade",
"style": "primary",
"bladeOpenContext": {
"bladeName": "CasesBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeJsonParameters": "{\r\n \"crossWorkspaceMode\": false\r\n}"
}
}
]
},
"name": "links - 1"
}
]
},
"customWidth": "30",
"name": "Text"
}
]
},
"name": "AlertsOverTime",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Incidents Over Time per Severity",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| summarize Count = count() by Severity, ProviderName, bin(TimeGenerated, 1d)",
"size": 0,
"showAnalytics": true,
"title": "Incidents Over Time by Severity, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart"
},
"customWidth": "95",
"name": "query-IncidentBySeverity"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| summarize Count = count() by ProviderName, bin(TimeGenerated, 1d)",
"size": 0,
"showAnalytics": true,
"title": "Incidents Over Time by Provider, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart"
},
"customWidth": "95",
"name": "query-IncidentByProvider"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident \r\n| summarize arg_max(TimeGenerated, *) by IncidentName \r\n| summarize by ProviderName, Severity, bin(TimeGenerated, 1d), IncidentName \r\n| evaluate pivot(Severity, count(), ProviderName, TimeGenerated) \r\n| order by TimeGenerated desc | project-reorder ProviderName, TimeGenerated, High, Medium, Low, Informational",
"size": 0,
"showAnalytics": true,
"title": "Incidents Over Time by Severity, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "High",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "Default",
"thresholdValue": null,
"representation": "Sev0",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Medium",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "Default",
"thresholdValue": null,
"representation": "Sev1",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Low",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "Default",
"thresholdValue": null,
"representation": "Sev2",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Informational",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "Default",
"thresholdValue": null,
"representation": "Sev3",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Severity",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "High",
"representation": "Sev0",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Medium",
"representation": "Sev1",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Low",
"representation": "Sev2",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Informational",
"representation": "Sev3",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Count",
"formatter": 8,
"formatOptions": {
"min": -100,
"palette": "blue"
}
}
],
"rowLimit": 10000,
"filter": true
}
},
"customWidth": "95",
"name": "Incidents Over Time "
}
]
},
"customWidth": "70",
"name": "Content"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Incidents by Severity\r\nIdentify how many incidents are being generated per severity and by which product. These stats are good to monitor in order to find where the threats are occuring the most and to what level. This can assist in finding weak spots within the environment or common causes for these alerts.\r\n\r\n[Microsoft Sentinel Analytic Rules](https://learn.microsoft.com/en-us/azure/sentinel/tutorial-log4j-detection) \r\n[Defender for Cloud Detections](https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference) \r\n[Microsoft 365 Defender Connector](https://learn.microsoft.com/en-us/azure/sentinel/microsoft-365-defender-sentinel-integration) \r\n",
"style": "upsell"
},
"name": "text - 1"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "list",
"links": [
{
"id": "cac11e31-4e5a-4b86-adcf-9ab9bb861b29",
"linkTarget": "OpenBlade",
"linkLabel": "Open Incidents Blade",
"style": "primary",
"bladeOpenContext": {
"bladeName": "CasesBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeJsonParameters": "{\r\n \"crossWorkspaceMode\": false\r\n}"
}
}
]
},
"name": "links - 1"
}
]
},
"customWidth": "30",
"name": "Text"
}
]
},
"name": "IncidentsOverTIme",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Incidents Owned Per User",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where Status != 'Closed'\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| summarize IncidentsOwned = count() by Owner = iff(isempty(Owner.userPrincipalName), 'Unassigned', tostring(Owner.userPrincipalName)), bin(TimeGenerated, 1d)\r\n",
"size": 0,
"showAnalytics": true,
"title": "Incidents Owned per User over {TimeRange}",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart",
"gridSettings": {
"filter": true
}
},
"name": "query-IncidentBySeverity - Copy"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| summarize IncidentsOwned = count() by Owner = tostring(Owner.userPrincipalName)\r\n| extend Owner = iff(isempty(Owner), 'Unassigned', Owner)",
"size": 0,
"showAnalytics": true,
"title": "Total Incidents Owned per User over {TimeRange}",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "table",
"gridSettings": {
"filter": true
}
},
"customWidth": "50",
"name": "query-IncidentBySeverity"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where Status != 'Closed'\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| summarize IncidentsOwned = count() by Owner = tostring(Owner.userPrincipalName), Severity\r\n| extend Owner = iff(isempty(Owner), 'Unassigned', Owner)\r\n| order by Owner asc",
"size": 0,
"showAnalytics": true,
"title": "Ongoing Incidents Owned per Severity per User over {TimeRange}",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Group",
"formatter": 1
},
{
"columnMatch": "Severity",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "High",
"representation": "Sev0",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Medium",
"representation": "Sev1",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Low",
"representation": "Sev2",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Informational",
"representation": "Sev3",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Count",
"formatter": 8,
"formatOptions": {
"min": -100,
"palette": "blue"
}
}
],
"filter": true
}
},
"customWidth": "50",
"name": "Incidents Over Time "
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SecurityIncident\r\n| where Status != 'Closed'\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| project TimeGenerated, Title, Owner = tostring(Owner.userPrincipalName), Severity\r\n| extend Owner = iff(isempty(Owner), 'Unassigned', Owner)\r\n| order by TimeGenerated desc",
"size": 2,
"showAnalytics": true,
"title": "Ongoing Incident List per User over {TimeRange}",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Severity",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "High",
"representation": "Sev0",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Medium",
"representation": "Sev1",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Low",
"representation": "Sev2",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Informational",
"representation": "Sev3",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Count",
"formatter": 8,
"formatOptions": {
"min": -100,
"palette": "blue"
}
}
],
"rowLimit": 10000,
"filter": true,
"hierarchySettings": {
"treeType": 1,
"groupBy": [
"Owner"
]
}
}
},
"name": "Incidents Over Time - Copy"
}
]
},
"customWidth": "70",
"name": "Content"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Incidents Owned per User\r\nIdentify how many incidents are owned by users within the environment in order to identify if there are inconsistencies in SOC team incident ownership. This insight can be used to ensure that the team is working in an optimized manner and that resources are not being overloaded while others are not receiving enough.\r\n",
"style": "upsell"
},
"name": "text - 1"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "list",
"links": [
{
"id": "cac11e31-4e5a-4b86-adcf-9ab9bb861b29",
"linkTarget": "OpenBlade",
"linkLabel": "Open Incidents Blade",
"style": "primary",
"bladeOpenContext": {
"bladeName": "CasesBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeJsonParameters": "{\r\n \"crossWorkspaceMode\": false\r\n}"
}
}
]
},
"name": "links - 1"
}
]
},
"customWidth": "30",
"name": "Text"
}
]
},
"name": "Incidents Owned Per User",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Failed Analytics",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_SentinelHealth()\r\n| where OperationName has 'analytics rule'\r\n| where Status == 'Failure'\r\n| summarize Count = count() by OperationName, bin(TimeGenerated, 1d)",
"size": 0,
"showAnalytics": true,
"title": "Total Failed Analytics, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart"
},
"customWidth": "95",
"name": "query-FailedRules"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_SentinelHealth()\r\n| where OperationName has 'analytics rule'\r\n| where Status == 'Failure'\r\n| summarize Count = count() by SentinelResourceName, OperationName, bin(TimeGenerated, 1d)",
"size": 0,
"showAnalytics": true,
"title": "Failed Analytic Run by Rule, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart"
},
"customWidth": "95",
"name": "query-FailedAnalyticsByRule"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_SentinelHealth()\r\n| where OperationName has 'analytics rule'\r\n| where Status == 'Failure'\r\n| project TimeGenerated, OperationName, SentinelResourceName, Status, Description, Reason\r\n| order by TimeGenerated desc",
"size": 2,
"showAnalytics": true,
"title": "List of Failed Analytics, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Group",
"formatter": 1
},
{
"columnMatch": "TimeGenerated",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "22ch"
}
},
{
"columnMatch": "OperationName",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "24ch"
}
}
],
"rowLimit": 10000,
"filter": true,
"hierarchySettings": {
"treeType": 1,
"groupBy": [
"SentinelResourceName"
]
},
"sortBy": [
{
"itemKey": "$gen_count_$gen_group_0",
"sortOrder": 1
}
],
"labelSettings": [
{
"columnId": "SentinelResourceName",
"label": "Rule Name"
}
]
},
"sortBy": [
{
"itemKey": "$gen_count_$gen_group_0",
"sortOrder": 1
}
]
},
"customWidth": "95",
"name": "Failed Analytics"
}
]
},
"customWidth": "70",
"name": "Content"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Failed Analytics\r\n\r\nAnalytics rules in Microsoft Sentinel play a crucial role in helping SOC teams to protect the organization against cyberattacks by identifying and detecting potential threats so that they can analyze and respond quickly to security incidents. Therefore, it is important for SOC engineers to ensure their detection rules are functioning correctly and producing relevant with actionable information.\r\n\r\nWith [Analytics Health and Audit Monitoring](https://learn.microsoft.com/azure/sentinel/monitor-analytics-rule-integrity), organizations can get insights into the health and rule running statuses. Besides that, SOC teams can use analytics health monitoring in the detection rule creation process in both production and pre-production environments.\r\n\r\nOnce enabled on your workspace, The log captures events that record the running of analytics rules, and the end result of these runnings—if they succeeded or failed, and if they failed, why.
\r\nThe log also records, for each running of an analytics rule:
\r\n - How many events were captured by the rule's query.\r\n - Whether the number of events passed the threshold defined in the rule, causing the rule to fire an alert.
\r\nThese logs are collected in the SentinelHealth table in Log Analytics.\r\n\r\nRefer to the list of [Statuses, errors and suggested steps](https://learn.microsoft.com/azure/sentinel/monitor-analytics-rule-integrity#statuses-errors-and-suggested-steps) for more information\r\n\r\n**How to enable Analytics Health:**\r\n - Follow the guidance on how to [Turn on auditing and health monitoring for Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/enable-monitoring)\r\n\r\n\tTo review if analytic rules are failing, review the SentinelHealth tables.\r\n\t[Microsoft Sentinel Health](https://learn.microsoft.com/azure/sentinel/health-table-reference#sentinelhealth-table-columns-schema)\r\n\r\n\r\n**Recommendation:**\r\n\r\nIf looking to be notified if a rule is failing, consider creating an analytic rules to check if there are rules that fail and generate logs in the SentinelHealth table.\r\n\r\n**Additional resources:**\r\n\r\n - [Blog - What’s new: Monitor the health and audit the integrity of your analytics rules](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-monitor-the-health-and-audit-the-integrity-of-your/ba-p/3736862)\r\n - [Demo - Monitor health and integrity of analytics rules](https://www.youtube.com/watch?v=o4X1tPpzl2A)\r\n - [Auditing and health monitoring in Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/health-audit)\r\n - [Monitor the health and audit the integrity of your analytics rules](https://learn.microsoft.com/azure/sentinel/monitor-analytics-rule-integrity)\r\n - [Microsoft Sentinel health tables reference](https://learn.microsoft.com/azure/sentinel/health-table-reference)",
"style": "upsell"
},
"name": "text - 1"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "paragraph",
"links": [
{
"id": "82cf504f-b72f-4b56-bd81-fff901b2c6de",
"linkTarget": "OpenBlade",
"linkLabel": "Open Settings page",
"style": "primary",
"bladeOpenContext": {
"bladeName": "SettingsBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": [
{
"name": "subscriptionId",
"source": "static",
"value": "{Workspace:subscriptionId}"
},
{
"name": "resourceGroup",
"source": "static",
"value": "{Workspace:resourcegroup}"
},
{
"name": "workspaceName",
"source": "static",
"value": "{Workspace:name}"
}
]
}
}
]
},
"name": "links - 1"
}
]
},
"customWidth": "30",
"name": "Text"
}
]
},
"name": "FailedAnalytics",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Top Modified Rules",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_SentinelAudit()\r\n| summarize Count = count() by Description, bin(TimeGenerated, 1d)",
"size": 0,
"showAnalytics": true,
"title": "Count of Actions Performed on Analytics, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart"
},
"customWidth": "95",
"name": "query-TopModifiedRule"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_SentinelAudit()\r\n| summarize Count = count() by SentinelResourceName, bin(TimeGenerated, 1d)",
"size": 0,
"showAnalytics": true,
"title": "Number of Actions Taken per Analytic Rule, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart"
},
"customWidth": "95",
"name": "query-TopModifiedPerRule"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_SentinelAudit()\r\n| summarize by TimeGenerated, Description, SentinelResourceName, Caller = tostring(ExtendedProperties.CallerName), Status\r\n| order by TimeGenerated desc",
"size": 2,
"showAnalytics": true,
"title": "Top Rules that have been Changed, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"rowLimit": 10000,
"filter": true,
"hierarchySettings": {
"treeType": 1,
"groupBy": [
"SentinelResourceName"
]
}
}
},
"customWidth": "95",
"name": "Top Rules Changed"
}
]
},
"customWidth": "70",
"name": "Content"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Modified Analytics\r\n\r\nModifying analytic rules can highlight fine tuning, correction, or malicious intent. Activity such as changing analytic rules will appear in the in SentinelAudit table and highlight which rule was modified.\r\n\r\nWith [Analytics Health and Audit Monitoring](https://learn.microsoft.com/azure/sentinel/monitor-analytics-rule-integrity), organizations can get a comprehensive view of what changes were made to an analytics rule (by who, from where, and when). This helps organizations to detect any unauthorized changes that may compromise security.\r\n\r\nOnce enabled on your workspace, the log captures events that record changes made to any analytics rule, including the following details:
\r\n - The name of the rule that was changed.\r\n - Which properties of the rule were changed.\r\n - The state of the rule settings before and after the change.\r\n - The user or identity that made the change.\r\n - The source IP and date/time of the change.\r\n - ...and more.\r\n\r\n**How to enable Analytics Audit:**\r\n - Follow the guidance on how to [Turn on auditing and health monitoring for Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/enable-monitoring)\r\n\r\n\tTo track actions by SOC analysts, review the SentinelAudit table.\r\n\t[Microsoft Sentinel Audit](https://learn.microsoft.com/azure/sentinel/audit-table-reference#sentinelaudit-table-columns-schema)\r\n\r\n**Recommendation:**\r\n\r\nIf looking to be notified for any unauthorized rule changes, consider creating an analytic rules to check if there are rules that being modified in the SentinelAudit table.\r\n\r\n**Additional resources:**\r\n\r\n - [Blog - What’s new: Monitor the health and audit the integrity of your analytics rules](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-monitor-the-health-and-audit-the-integrity-of-your/ba-p/3736862)\r\n - [Demo - Monitor health and integrity of analytics rules](https://www.youtube.com/watch?v=o4X1tPpzl2A)\r\n - [Auditing and health monitoring in Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/health-audit)\r\n - [Monitor the health and audit the integrity of your analytics rules](https://learn.microsoft.com/azure/sentinel/monitor-analytics-rule-integrity)\r\n - [Microsoft Sentinel health tables reference](https://learn.microsoft.com/azure/sentinel/health-table-reference)",
"style": "upsell"
},
"name": "text - 1"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "paragraph",
"links": [
{
"id": "82cf504f-b72f-4b56-bd81-fff901b2c6de",
"linkTarget": "OpenBlade",
"linkLabel": "Open Settings page",
"style": "primary",
"bladeOpenContext": {
"bladeName": "SettingsBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": [
{
"name": "subscriptionId",
"source": "static",
"value": "{Workspace:subscriptionId}"
},
{
"name": "resourceGroup",
"source": "static",
"value": "{Workspace:resourcegroup}"
},
{
"name": "workspaceName",
"source": "static",
"value": "{Workspace:name}"
}
]
}
}
]
},
"name": "links - 1"
}
]
},
"customWidth": "30",
"name": "Text"
}
]
},
"name": "ModifiedRules",
"styleSettings": {
"showBorder": true
}
}
]
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "2"
},
"name": "Operation Optimization and Effectiveness"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Workspace & Table Retention",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces' \r\n| where id has \"{Workspace}\"\r\n| extend state = trim(' ', tostring(properties.provisioningState))\r\n\t\t,sku = trim(' ', tostring(properties.sku.name))\r\n ,skuUpdate = trim(' ', tostring(properties.sku.lastSkuUpdate))\r\n\t\t,retentionDays = trim(' ', tostring(properties.retentionInDays))\r\n\t\t,dailyquotaGB = trim(' ', tostring(properties.workspaceCapping.dailyQuotaGb))\r\n| extend dailyquotaGB = iif(dailyquotaGB !=-1.0, dailyquotaGB,\"Not set\")\r\n| extend skuUpdate = iif(strlen(skuUpdate) > 0, skuUpdate,\"Unknown\")\r\n| extend sentinel = iif(toint(retentionDays) < 90,\"If you have Sentinel, you can change your retention to 90days (free)?\",\"\")\r\n| project ['Log Analytics Workspace Name']=id, ['Resource Group']=resourceGroup, location, ['Data Retention(days)']=retentionDays, ['Last known SKU update']=skuUpdate, ['Daily Data Cap']=dailyquotaGB, ['Licence']=sku, ['Commitment Tier']=properties.sku.capacityReservationLevel, ['Notes'] = sentinel",
"size": 4,
"title": "Workspace Retention Summary",
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Data Retention(days)",
"formatter": 0,
"formatOptions": {
"showIcon": true
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"useGrouping": false
}
}
},
{
"columnMatch": "Last known SKU update",
"formatter": 18,
"formatOptions": {
"showIcon": true,
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "is Empty",
"thresholdValue": "\" \"",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Daily Data Cap",
"formatter": 18,
"formatOptions": {
"showIcon": true,
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "not set",
"representation": "Unavailable",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "1",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "Data Retention",
"formatter": 0,
"formatOptions": {
"showIcon": true
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"useGrouping": false
}
}
}
],
"sortBy": [
{
"itemKey": "$gen_number_Data Retention(days)_3",
"sortOrder": 1
}
]
},
"sortBy": [
{
"itemKey": "$gen_number_Data Retention(days)_3",
"sortOrder": 1
}
]
},
"customWidth": "98",
"name": "query-WorkspaceRetention"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourcegroups/{Workspace:resourcegroup}/providers/microsoft.operationalinsights/workspaces/{Workspace:name}/tables?api-version=2021-12-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value[*]\",\"columns\":[{\"path\":\"name\",\"columnid\":\"TableName\",\"columnType\":\"string\"},{\"path\":\"properties.plan\",\"columnid\":\"Plan\",\"columnType\":\"string\"},{\"path\":\"properties.totalRetentionInDays\",\"columnid\":\"TotalRetentionInDays\",\"columnType\":\"long\"},{\"path\":\"$..properties.retentionInDays\",\"columnid\":\"InteractiveRetentionInDays\",\"columnType\":\"long\"},{\"path\":\"properties.archiveRetentionInDays\",\"columnid\":\"ArchiveRetentionInDays\",\"columnType\":\"long\"}]}}]}",
"size": 1,
"queryType": 12
},
"conditionalVisibility": {
"parameterName": "Test",
"comparison": "isEqualTo",
"value": "1"
},
"name": "query-Tables-Temp1"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "Usage\r\n| where StartTime {TimeRange:value}\r\n| where IsBillable == 'true'\r\n| summarize ['Table Size'] =sum(Quantity) by DataType\r\n| order by DataType asc",
"size": 1,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "table"
},
"conditionalVisibility": {
"parameterName": "test",
"comparison": "isEqualTo",
"value": "1"
},
"name": "query-Tables-Temp2"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"Merge/1.0\",\"merges\":[{\"id\":\"0f9ad000-9d3d-4d9d-87eb-b3c438eca14c\",\"mergeType\":\"leftouter\",\"leftTable\":\"query-Tables-Temp2\",\"rightTable\":\"query-Tables-Temp1\",\"leftColumn\":\"DataType\",\"rightColumn\":\"TableName\"}],\"projectRename\":[{\"originalName\":\"[query-Tables-Temp2].DataType\",\"mergedName\":\"TableName\",\"fromId\":\"0f9ad000-9d3d-4d9d-87eb-b3c438eca14c\"},{\"originalName\":\"[query-Tables-Temp2].Table Size\",\"mergedName\":\"Table Size\",\"fromId\":\"0f9ad000-9d3d-4d9d-87eb-b3c438eca14c\"},{\"originalName\":\"[query-Tables-Temp1].Plan\",\"mergedName\":\"Plan\",\"fromId\":\"0f9ad000-9d3d-4d9d-87eb-b3c438eca14c\"},{\"originalName\":\"[query-Tables-Temp1].TotalRetentionInDays\",\"mergedName\":\"TotalRetentionInDays\",\"fromId\":\"0f9ad000-9d3d-4d9d-87eb-b3c438eca14c\"},{\"originalName\":\"[query-Tables-Temp1].InteractiveRetentionInDays\",\"mergedName\":\"InteractiveRetentionInDays\",\"fromId\":\"0f9ad000-9d3d-4d9d-87eb-b3c438eca14c\"},{\"originalName\":\"[query-Tables-Temp1].ArchiveRetentionInDays\",\"mergedName\":\"ArchiveRetentionInDays\",\"fromId\":\"0f9ad000-9d3d-4d9d-87eb-b3c438eca14c\"},{\"originalName\":\"[query-Tables-Temp1].TableName\"}]}",
"size": 2,
"title": "Table Retention and Size, from: {TimeRange:label} data (only tables with usage are shown)",
"queryType": 7,
"gridSettings": {
"formatters": [
{
"columnMatch": "TableName",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "37ch"
}
},
{
"columnMatch": "Table Size",
"formatter": 4,
"formatOptions": {
"min": -300,
"palette": "greenRed",
"compositeBarSettings": {
"labelText": "",
"columnSettings": []
},
"customColumnWidthSetting": "110px"
},
"numberFormat": {
"unit": 38,
"options": {
"style": "decimal",
"maximumFractionDigits": 2
}
}
},
{
"columnMatch": "Plan",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "Analytics",
"representation": "blueDark",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Basic",
"representation": "yellow",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "blue",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "11ch"
}
},
{
"columnMatch": "TotalRetentionInDays",
"formatter": 8,
"formatOptions": {
"min": 0,
"palette": "turquoise",
"customColumnWidthSetting": "24ch"
}
},
{
"columnMatch": "InteractiveRetentionInDays",
"formatter": 8,
"formatOptions": {
"min": 8,
"max": 730,
"palette": "purpleBlue",
"customColumnWidthSetting": "28ch"
}
},
{
"columnMatch": "ArchiveRetentionInDays",
"formatter": 8,
"formatOptions": {
"min": -50,
"palette": "purpleDark",
"customColumnWidthSetting": "26ch"
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
}
],
"sortBy": [
{
"itemKey": "TableName",
"sortOrder": 1
}
]
},
"sortBy": [
{
"itemKey": "TableName",
"sortOrder": 1
}
]
},
"customWidth": "98",
"showPin": false,
"name": "query-Tables"
}
]
},
"customWidth": "70",
"name": "groupTables"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Workspace & Table Retention ###\r\n\r\nOnce Microsoft Sentinel is enabled on your Azure Monitor Log Analytics workspace, every GB of data ingested into the workspace can be retained at **no charge for the first 90 days**. \r\n\r\nRetention beyond 90 days will be charged per the standard Azure Monitor Log Analytics retention prices. \r\n- [Microsoft Sentinel Pricing](https://azure.microsoft.com/pricing/details/microsoft-sentinel/)\r\n\r\nIf you need to keep data for longer than 90 days, you can configure **Archive retention** as a low cost long term data storage option. \r\n\r\nBy default, all tables in your workspace inherit the workspace's interactive retention setting and have no archive policy. You can modify the retention and archive policies of individual tables, except for workspaces in the legacy Free Trial pricing tier.\r\n\r\nYou can keep data in interactive retention between 4 and 730 days. You can set the archive period for a total retention time of up to 2,556 days (seven years).\r\n\r\n**Review your workspace and table retention** presented in the tables on the left. Refer to the links below on how to configure default workspace retention policy and set retention and archive policy by table.\r\n- [Configure the default workspace retention policy](https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#configure-the-default-workspace-retention-policy)\r\n\r\n- [Set retention and archive policy by table](https://learn.microsoft.com/azure/sentinel/configure-data-retention)",
"style": "upsell"
},
"name": "text-Retention"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "list",
"links": [
{
"id": "2b8f0ca5-1278-4ea2-a851-94c61372a1a4",
"cellValue": "",
"linkTarget": "OpenBlade",
"linkLabel": "Open Tables page",
"subTarget": "test",
"style": "primary",
"bladeOpenContext": {
"bladeName": "TablesBlade",
"extensionName": "Microsoft_OperationsManagementSuite_Workspace",
"bladeParameters": [
{
"name": "workspaceResourceId",
"source": "static",
"value": "{Workspace:id}"
}
]
}
}
]
},
"name": "links-OpenRetention"
}
]
},
"customWidth": "30",
"name": "groupInsights-Retention"
}
]
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "3"
},
"name": "group-WorskpaceRetention",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Microsoft Defender for Cloud Benefit",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "// https://docs.microsoft.com/azure/azure-monitor/logs/manage-cost-storage#log-analytics-and-security-center\r\nlet ascTables = dynamic(['WindowsEvent', 'SecurityAlert', 'SecurityBaseline', 'SecurityBaselineSummary', 'SecurityDetection', 'SecurityEvent','WindowsFirewall', 'MaliciousIPCommunication', 'LinuxAuditLog', 'SysmonEvent', 'ProtectionStatus']);\r\nunion withsource = tt *\r\n| where _IsBillable == True\r\n// Calculate the daily GB size per billable Table and unique Server count \r\n| summarize allGBytes =sum(_BilledSize)/(1024*1024*1024), ascGBytes=sumif(_BilledSize, Type in (ascTables))/(1024*1024*1024), ascComputerCount = dcountif(Computer,tt in (ascTables)) by bin(TimeGenerated, 1d)\r\n// Calculate daily GB average, and average ASC server count. Each Server is allowed max 0.5GB each\r\n| summarize avg(allGBytes), avg(ascGBytes),ascComputers=round(avg(ascComputerCount),0),ascMaxGB = avg(ascComputerCount) * 0.5\r\n// If ASC sends less than the allowed max, revise the GB averge per day, else use the max allowed (all servers * 0.5)\r\n| extend revisedNumber = iif(avg_ascGBytes <= ascMaxGB, allMinusASCused = (avg_allGBytes - avg_ascGBytes),allMinusASCused = (avg_allGBytes - ascMaxGB) )\r\n| extend withinPool = iif(avg_ascGBytes >= ascMaxGB,\"Yes\",\"No\")\r\n| extend overBy = iif(round(avg_ascGBytes,2) - round(ascMaxGB,2) < 0 , toreal(0), round(avg_ascGBytes,2) - round(ascMaxGB,2) )\r\n| project ['Raw Average GB'] = avg_allGBytes,\r\n ['Defender has used, GB'] = strcat(round(avg_ascGBytes,1),\" GB of \" ,round(ascMaxGB,1), \" GB across \", ascComputers , \" Computers\"), \r\n ['Revised GB Number']= round(revisedNumber,2),\r\n ['Sent more than allocation?'] = withinPool,\r\n ['Overage in GB'] = overBy\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n",
"size": 4,
"aggregation": 3,
"title": "Average GB per day, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "Raw Average GB",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "20ch"
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"useGrouping": false,
"maximumSignificantDigits": 3
}
}
},
{
"columnMatch": "Defender has used, GB",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "40ch"
}
},
{
"columnMatch": "Sent more than allocation?",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "yes",
"representation": "2",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "28ch"
}
},
{
"columnMatch": "Overage in GB",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "18ch"
}
},
{
"columnMatch": "ASC has used, GB",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumSignificantDigits": 3
}
}
},
{
"columnMatch": "ASC has used",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumSignificantDigits": 3
}
}
},
{
"columnMatch": "Revised Number",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumSignificantDigits": 3
}
}
},
{
"columnMatch": "Average GB/day",
"formatter": 0,
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"maximumSignificantDigits": 3
}
}
},
{
"columnMatch": "Average GB per day",
"formatter": 0,
"numberFormat": {
"unit": 2,
"options": {
"style": "decimal",
"useGrouping": false,
"maximumSignificantDigits": 3
}
}
},
{
"columnMatch": "Adjusted for ASC standard 500MB allowance",
"formatter": 0,
"numberFormat": {
"unit": 2,
"options": {
"style": "decimal",
"useGrouping": false,
"maximumSignificantDigits": 3
}
}
},
{
"columnMatch": "sum_ASCs",
"formatter": 0,
"numberFormat": {
"unit": 2,
"options": {
"style": "decimal",
"useGrouping": false,
"maximumSignificantDigits": 3
}
}
},
{
"columnMatch": "ASCsize",
"formatter": 0,
"numberFormat": {
"unit": 2,
"options": {
"style": "decimal",
"useGrouping": false,
"maximumSignificantDigits": 3
}
}
},
{
"columnMatch": "Adjusted for ASC standard",
"formatter": 0,
"numberFormat": {
"unit": 2,
"options": {
"style": "decimal",
"useGrouping": false,
"maximumSignificantDigits": 3
}
}
},
{
"columnMatch": "avg_TotalGBytes",
"formatter": 0,
"numberFormat": {
"unit": 2,
"options": {
"style": "decimal",
"useGrouping": false,
"maximumSignificantDigits": 3
}
}
}
]
},
"sortBy": [],
"chartSettings": {
"showMetrics": false,
"seriesLabelSettings": [
{
"seriesName": "BillingVolumeNow",
"color": "green"
},
{
"seriesName": "BillingForecast",
"color": "redBright"
}
]
}
},
"customWidth": "99",
"name": "query-MDfCusage"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "find in (WindowsEvent, SecurityAlert, SecurityBaseline, SecurityBaselineSummary, SecurityDetection, SecurityEvent,WindowsFirewall, MaliciousIPCommunication, LinuxAuditLog, SysmonEvent, ProtectionStatus) where isnotempty(_BilledSize) project _BilledSize, Computer, TimeGenerated\r\n// ASC Standard allows 500MB per machine - in a pool \r\n| summarize allowedMBytes=500000000 * dcount(Computer), usedMBytes=sum(_BilledSize) , dcount(Computer) by bin(TimeGenerated,{TimeRange:grain})\r\n",
"size": 0,
"aggregation": 3,
"title": "Defender for Cloud, allowance vs. in use, from: {TimeRange:label}",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "unstackedbar",
"gridSettings": {
"formatters": [
{
"columnMatch": "MBytes",
"formatter": 0,
"formatOptions": {},
"numberFormat": {
"unit": 2,
"options": {
"style": "decimal",
"useGrouping": false
}
}
},
{
"columnMatch": "Table Size",
"formatter": 8,
"formatOptions": {
"palette": "greenRed"
},
"numberFormat": {
"unit": 2,
"options": {
"style": "decimal",
"useGrouping": false,
"maximumSignificantDigits": 2
}
}
},
{
"columnMatch": "bill",
"formatter": 0,
"formatOptions": {},
"numberFormat": {
"unit": 2,
"options": {
"style": "decimal",
"useGrouping": false,
"maximumSignificantDigits": 2
}
}
}
],
"sortBy": [
{
"itemKey": "TimeGenerated",
"sortOrder": 2
}
]
},
"sortBy": [
{
"itemKey": "TimeGenerated",
"sortOrder": 2
}
],
"chartSettings": {
"seriesLabelSettings": [
{
"seriesName": "BillingVolumeNow",
"color": "green"
},
{
"seriesName": "BillingForecast",
"color": "redBright"
}
],
"ySettings": {
"numberFormatSettings": {
"unit": 36,
"options": {
"style": "decimal",
"useGrouping": true,
"maximumFractionDigits": 2
}
}
}
}
},
"customWidth": "99",
"name": "query-MDfCAllowance"
}
]
},
"customWidth": "70",
"name": "Content"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "\r\n### Microsoft Defender for Cloud Benefit\r\n\r\n[Microsoft Defender for Servers Plan 2](https://learn.microsoft.com/azure/defender-for-cloud/faq-defender-for-servers#is-the-500-mb-of-free-data-ingestion-allowance-applied-per-workspace-or-per-machine-) provides a 500 MB/node/day free ingestion for the [security data types](https://learn.microsoft.com/azure/defender-for-cloud/faq-defender-for-servers#what-data-types-are-included-in-the-daily-allowance-) that are directly collected by Defender for Cloud.\r\n\r\nThis allowance is a daily rate that's averaged across all nodes. Your total daily free limit is equal to [number of machines] × 500 MB. You aren't charged extra if the total doesn't exceed your total daily free limit, even if some machines send 100 MB and others send 800 MB.\r\n\r\nAny data over this number will have the standard charge applied.\r\n\r\nNote that the **Microsoft Defender for Servers P2 benefit** security data ingestion into Log Analytics has been extended to the **[simplified pricing tiers](https://learn.microsoft.com/azure/sentinel/billing?tabs=simplified%2Ccommitment-tiers#simplified-pricing-tiers)**. That means instead of the benefit only applying to the LA meter (e.g., $2.30/GB PayGO meter), the benefit will now apply to the totality of the new simplified meter. This greatly increases the financial benefit of bringing eligible data ingested into Microsoft Sentinel for each VM protected in this manner.\r\n",
"style": "upsell"
},
"name": "text-MDfC"
}
]
},
"customWidth": "30",
"name": "groupInsights-MDfC"
}
]
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "3"
},
"name": "query-MDfCBenefit",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Automation Rules",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SentinelHealth \r\n|where OperationName contains \"Automation rule run\"\r\n|summarize count() by Status",
"size": 1,
"title": "Automation Rule Run Status, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "piechart",
"tileSettings": {
"showBorder": false
},
"graphSettings": {
"type": 0
},
"chartSettings": {
"seriesLabelSettings": [
{
"seriesName": "Failure",
"color": "red"
},
{
"seriesName": "Success",
"color": "blue"
},
{
"seriesName": "Partial success",
"color": "orange"
}
]
}
},
"customWidth": "70",
"name": "query-AutomationHealth"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_SentinelHealth()\r\n| where SentinelResourceType == \"Automation rule\"\r\n| summarize count() by Status, bin(TimeGenerated,1h)",
"size": 0,
"title": "Automation Rule Run Tending Over Time",
"timeContextFromParameter": "TimeRange",
"timeBrushParameterName": "AutomationRuleTime",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart",
"chartSettings": {
"seriesLabelSettings": [
{
"seriesName": "Failure",
"color": "red"
},
{
"seriesName": "Success",
"color": "blue"
},
{
"seriesName": "Partial success",
"color": "orange"
}
]
}
},
"customWidth": "98",
"name": "query-AutomationRuleStatusTrending"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_SentinelHealth()\r\n| where OperationName == \"Automation rule run\"\r\n|summarize Success=count(Status=='Success'), Failure=count(Status=='Failure'),PartialSuccess=count(Status=='Partial success') by SentinelResourceName, SentinelResourceId\r\n| order by SentinelResourceName asc",
"size": 0,
"title": "Automation Rule Run Status, from: {AutomationRuleTime:label} data",
"timeContextFromParameter": "AutomationRuleTime",
"exportedParameters": [
{
"fieldName": "SentinelResourceId",
"parameterName": "SentinelResourceId"
},
{
"fieldName": "SentinelResourceName",
"parameterName": "SentinelResourceName",
"parameterType": 1
}
],
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "SentinelResourceName",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "60ch"
}
},
{
"columnMatch": "SentinelResourceId",
"formatter": 5
},
{
"columnMatch": "Success",
"formatter": 8,
"formatOptions": {
"min": -5000,
"palette": "green",
"customColumnWidthSetting": "17ch"
}
},
{
"columnMatch": "Failure",
"formatter": 8,
"formatOptions": {
"min": -500,
"palette": "red",
"customColumnWidthSetting": "17ch"
}
},
{
"columnMatch": "PartialSuccess",
"formatter": 8,
"formatOptions": {
"min": -500000,
"max": 500000,
"palette": "orange",
"customColumnWidthSetting": "17ch"
}
}
],
"labelSettings": [
{
"columnId": "SentinelResourceName",
"label": "Automation Rule"
}
]
}
},
"customWidth": "98",
"name": "query-TopAutomationRules"
},
{
"type": 1,
"content": {
"json": "Select an automation rule from the table above to view the details.",
"style": "info"
},
"conditionalVisibilities": [
{
"parameterName": "SentinelResourceId",
"comparison": "isEqualTo"
},
{
"parameterName": "Help",
"comparison": "isEqualTo",
"value": "Yes"
}
],
"name": "text-AutomationRuleDetails"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_SentinelHealth()\r\n| where OperationName == \"Automation rule run\"\r\n| where SentinelResourceId == \"{SentinelResourceId}\"\r\n| project TimeGenerated, SentinelResourceName, Status, Description, Reason, ExtendedProperties\r\n| order by TimeGenerated desc\r\n\r\n",
"size": 0,
"title": "Automation rule run details for \"{SentinelResourceName}\"",
"timeContextFromParameter": "AutomationRuleTime",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "TimeGenerated",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "26ch"
}
}
],
"rowLimit": 10000,
"labelSettings": [
{
"columnId": "SentinelResourceName",
"label": "Automation Rule"
}
]
}
},
"customWidth": "98",
"conditionalVisibility": {
"parameterName": "SentinelResourceId",
"comparison": "isNotEqualTo"
},
"name": "query-AutomationByStatus"
}
]
},
"customWidth": "70",
"name": "group-AutomationRules"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "\r\n## Automate Responses ##\r\nMicrosoft Sentinel is a cloud-native security information and event management (SIEM) and SOAR system that provides various automation options for the enterprise. \r\n\r\nAutomation Rules allow security analysts to automate certain tasks and responses to specific security events. Automation rules are designed to trigger automated actions to incidents when certain conditions are met. \r\n\r\nAutomation rules are the starting point for Microsoft Sentinel automation. They provide a lightweight method for central automated handling of incidents, including suppression, false-positive handling, and automatic assignment.\r\n\r\nYou can [monitor the health of your automation rules](https://learn.microsoft.com/azure/sentinel/monitor-automation-health) with health logs.\r\n\r\n**Here are some recommendations for automation in Microsoft Sentinel:**\r\n\r\n1) Incident tasks. Create automation rules to standardize and formalize the steps required for the triaging, investigation, and remediation of incidents.
\r\n- [Use tasks to manage incidents in Microsoft Sentinel.](https://learn.microsoft.com/azure/sentinel/incident-tasks)\r\n\r\n- [Create incident tasks in Microsoft Sentinel using automation rules](https://learn.microsoft.com/azure/sentinel/create-tasks-automation-rule)\r\n\r\n2) Playbooks can be used to respond to incidents as described in the use cases available here:\r\n- [Use cases for playbooks](https://learn.microsoft.com/azure/sentinel/automate-responses-with-playbooks#use-cases-for-playbooks)\r\n\r\n\r\n**Additional resources:**\r\n\r\n- Learn how to [create and use Microsoft Sentinel automation rules to manage response](https://learn.microsoft.com/azure/sentinel/create-manage-use-automation-rules)\r\n\r\n- [Add advanced conditions to Microsoft Sentinel automation rules](https://learn.microsoft.com/azure/sentinel/add-advanced-conditions-to-automation-rules)\r\n\r\n- [Migrate your Microsoft Sentinel alert-trigger playbooks to automation rules](https://learn.microsoft.com/azure/sentinel/migrate-playbooks-to-automation-rules)",
"style": "upsell"
},
"name": "Automate Response"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "paragraph",
"links": [
{
"id": "ae10c129-5ced-4e14-969c-14ff79304403",
"linkTarget": "OpenBlade",
"linkLabel": "Open Automation Blade",
"style": "primary",
"bladeOpenContext": {
"bladeName": "AutomationBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": []
}
}
]
},
"name": "links-AutomationRules"
}
]
},
"customWidth": "30",
"name": "groupInsights-AutomationRule"
}
]
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "3"
},
"name": "group-AtomationRules",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Playbooks",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_SentinelHealth()\r\n| where SentinelResourceType == \"Playbook\"\r\n|summarize count() by Status",
"size": 1,
"title": "Playbook Run Status, from: {TimeRange:label} data",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "piechart",
"tileSettings": {
"showBorder": false
},
"graphSettings": {
"type": 0
},
"chartSettings": {
"seriesLabelSettings": [
{
"seriesName": "Failure",
"color": "red"
},
{
"seriesName": "Success",
"color": "blue"
},
{
"seriesName": "Partial success",
"color": "orange"
}
]
}
},
"customWidth": "70",
"name": "query-PlaybookHealth"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_SentinelHealth()\r\n| where SentinelResourceType == \"Playbook\"\r\n| summarize count() by Status, bin(TimeGenerated,1h)",
"size": 0,
"title": "Playbook Run Tending Over Time",
"timeContextFromParameter": "TimeRange",
"timeBrushParameterName": "PlaybookTime",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart",
"chartSettings": {
"seriesLabelSettings": [
{
"seriesName": "Failure",
"color": "red"
},
{
"seriesName": "Success",
"color": "blue"
},
{
"seriesName": "Partial success",
"color": "orange"
}
]
}
},
"customWidth": "98",
"name": "query-PlaybookStatusTrending"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_SentinelHealth()\r\n| where SentinelResourceType == \"Playbook\"\r\n|summarize Success=count(Status=='Success'), Failure=count(Status=='Failure') by SentinelResourceName, SentinelResourceId\r\n| order by SentinelResourceName asc",
"size": 0,
"title": "Playbook Run Status, from: {PlaybookTime:label} data",
"timeContextFromParameter": "PlaybookTime",
"exportedParameters": [
{
"fieldName": "SentinelResourceId",
"parameterName": "SentinelResourceId"
},
{
"fieldName": "SentinelResourceName",
"parameterName": "SentinelResourceName",
"parameterType": 1
}
],
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "SentinelResourceName",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "60ch"
}
},
{
"columnMatch": "SentinelResourceId",
"formatter": 5
},
{
"columnMatch": "Success",
"formatter": 8,
"formatOptions": {
"min": -5000,
"palette": "green",
"customColumnWidthSetting": "17ch"
}
},
{
"columnMatch": "Failure",
"formatter": 8,
"formatOptions": {
"min": -500,
"palette": "red",
"customColumnWidthSetting": "17ch"
}
},
{
"columnMatch": "PartialSuccess",
"formatter": 8,
"formatOptions": {
"min": -500000,
"max": 500000,
"palette": "orange",
"customColumnWidthSetting": "17ch"
}
}
],
"labelSettings": [
{
"columnId": "SentinelResourceName",
"label": "Playbook Name"
}
]
}
},
"customWidth": "98",
"name": "query-TopPlaybookRules"
},
{
"type": 1,
"content": {
"json": "Select a Playbook from the table above to view the details.",
"style": "info"
},
"conditionalVisibilities": [
{
"parameterName": "SentinelResourceId",
"comparison": "isEqualTo"
},
{
"parameterName": "Help",
"comparison": "isEqualTo",
"value": "Yes"
}
],
"name": "text-PlaybookDetails"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_SentinelHealth()\r\n| where SentinelResourceType == \"Playbook\"\r\n| where SentinelResourceId == \"{SentinelResourceId}\"\r\n| project TimeGenerated, SentinelResourceName, Status, Description, Reason, ExtendedProperties\r\n| order by TimeGenerated desc\r\n\r\n",
"size": 0,
"title": "Playbook run details for \"{SentinelResourceName}\"",
"timeContextFromParameter": "PlaybookTime",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "TimeGenerated",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "26ch"
}
}
],
"rowLimit": 10000,
"labelSettings": [
{
"columnId": "SentinelResourceName",
"label": "Playbook Name"
}
]
}
},
"customWidth": "98",
"conditionalVisibility": {
"parameterName": "SentinelResourceId",
"comparison": "isNotEqualTo"
},
"name": "query-PlaybookByStatus"
}
]
},
"customWidth": "70",
"name": "group-Playbook"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Playbooks###\r\n\r\nMicrosoft Sentinel playbooks are a set of automated workflows that can help you respond to security events more efficiently and effectively. \r\n\r\nUse cases for playbooks include:\r\n\r\n* Incident enrichment using Threat Intelligence feeds. \r\n* Incident management scenarios like assigning incidents to analysts, sending email notifications and posting on a Teams channel. \r\n* Remediation action when a certain incident type is created. For example, respond to a compromised user or machine by isolating the machine or quarantining the user.\r\n\r\nPermissions required to run playbooks are explained here: [Authenticate playbooks to Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/authenticate-playbooks-to-sentinel) and [Use triggers and actions in Microsoft Sentinel playbooks](https://learn.microsoft.com/azure/sentinel/playbook-triggers-actions#permissions-required)\r\n\r\n**You can get playbook templates from the following sources:**\r\n\r\n- The **Playbook templates tab** (under Automation) presents the leading scenarios contributed by the Microsoft Sentinel community. Multiple active playbooks can be created from the same template.\r\n\r\n- When a new version of the template is published, the active playbooks created from that template (in the Playbooks tab) will be labeled with a notification that an update is available.\r\n\r\n- Playbook templates can also be obtained as part of a **Microsoft Sentinel solution** in the context of a specific product. The deployment of the solution produces active playbooks.\r\n\r\n- The **Microsoft Sentinel GitHub** repository contains many [playbook templates](https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks). They can be deployed to an Azure subscription by selecting the Deploy to Azure button.\r\n\r\nReview on how to [create and customize Microsoft Sentinel playbooks from built-in templates]( https://learn.microsoft.com/azure/sentinel/use-playbook-templates) for more details.\r\n\r\n\r\nOnce created, playbooks can be run manually or attached to automation rules. \r\n\r\n**Additional resources:**\r\n\r\n- You can [monitor the health of your Playbooks](https://learn.microsoft.com/azure/sentinel/monitor-automation-health) with health logs.\r\n\r\n- Learn how to [configure advanced security for Microsoft Sentinel playbooks](https://learn.microsoft.com/azure/sentinel/define-playbook-access-restrictions)\r\n\r\n- Sample use case: [Create and perform incident tasks in Microsoft Sentinel using playbooks](https://learn.microsoft.com/azure/sentinel/create-tasks-playbook)\r\n\r\n- Tutorial: [Use playbooks with automation rules in Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/tutorial-respond-threats-playbook?tabs=LAC%2Cincidents)",
"style": "upsell"
},
"name": "text - 3"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "paragraph",
"links": [
{
"id": "ae10c129-5ced-4e14-969c-14ff79304403",
"linkTarget": "OpenBlade",
"linkLabel": "Open Automation Blade",
"style": "primary",
"bladeOpenContext": {
"bladeName": "AutomationBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": []
}
}
]
},
"name": "links-AutomationRules"
}
]
},
"customWidth": "30",
"name": "groupInsights-Playbook"
}
]
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "3"
},
"name": "group-Playbooks",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Workbooks",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('/workspaces/{Workspace:name}')\r\n| summarize count()\r\n",
"size": 4,
"title": "Number of Active Workbooks",
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources",
"crossComponentResources": [
"{Subscription}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {},
"leftContent": {
"columnMatch": "count_",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "magenta"
}
},
"showBorder": false
},
"textSettings": {
"style": "bignumber"
}
},
"name": "query-WorkbookCount"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "resources\r\n| where type == \"microsoft.insights/workbooks\"\r\n| where properties.sourceId has tostring('/workspaces/{Workspace:name}')\r\n| extend Workbook = tostring(properties.displayName)\r\n| project Workbook, id, TimeModified = tostring(properties.timeModified)\r\n| order by Workbook asc",
"size": 2,
"title": "Current Deployed Workbooks",
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources",
"crossComponentResources": [
"{Subscription}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "Workbook",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "80ch"
}
},
{
"columnMatch": "id",
"formatter": 5
},
{
"columnMatch": "TimeModified",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "25ch"
}
}
],
"rowLimit": 1000,
"filter": true
}
},
"name": "query-WorkbookName"
}
]
},
"customWidth": "70",
"name": "Content"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "## Workbooks##\r\n\r\nMicrosoft Sentinel workbooks are powerful tools that provide visual insights into your security environment, allowing you to identify and respond to security threats in real-time. \r\n\r\n**Here are some recommended Microsoft Sentinel workbooks to have:**\r\n \r\n- **Microsoft Sentinel Cost**: Use it to help estimate costs and understand the data grant benefit of the E5/A5/G5 licenses\r\n\r\n- **Log Sources & Analytic Rules Coverage**: To show different tables in the LAW and different Microsoft Sentinel features use them like analytic rules, searches and queries, hunting queries\r\n\r\n- **Analytics Efficiency**: To understand how analytic rules are running, are they generating alerts or incidents \r\n\r\n- **Archiving, Basic Logs, and Retention**: To show the LAW tables, the ingestion tier i.e. Basic or Analytic logs, the Archive set and total Retention\r\n\r\n- **SOC efficiency**: To view overall SOC efficiency metrics and measures regarding the performance of their team e.g. time to solve an incident\r\n\r\nhttps://docs.microsoft.com/azure/sentinel/top-workbooks",
"style": "upsell"
},
"name": "text - Workbook"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "paragraph",
"links": [
{
"id": "3e97d17b-ae77-4b63-8834-bdca0fbdbf11",
"linkTarget": "OpenBlade",
"linkLabel": "Open Workbooks Blade",
"style": "primary",
"bladeOpenContext": {
"bladeName": "WorkbooksBlade",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": [
{
"name": "subscriptionId",
"source": "static",
"value": "{Workspace:subscriptionId}"
},
{
"name": "resourceGroup",
"source": "static",
"value": "{Workspace:resourceGroup}"
},
{
"name": "workspaceName",
"source": "static",
"value": "{Workspace:name}"
}
]
}
}
]
},
"name": "links-Workbook"
}
]
},
"customWidth": "30",
"name": "Text"
}
]
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "3"
},
"name": "group-Workbooks",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Threat Intelligence Indicators",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicators\r\n// Select all indicators from the table\r\n| where TimeGenerated < now()\r\n// Select only indicators that have not expired\r\n and ValidUntil > now()\r\n// Select only indicators that are marked active\r\n and IsActive == true\r\n// Select only the most recently ingested copy of an indicator\r\n| summarize arg_max(TimeGenerated, *) by Id\r\n// Summarize and order the data, then render the chart\r\n| summarize CountOfIndicators = count() by SourceSystem\r\n| order by CountOfIndicators desc \r\n| render barchart kind=unstacked",
"size": 0,
"showAnalytics": true,
"title": "Active Indicators by Indicator Source",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
]
},
"name": "query - TIBySource"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicators\r\n// Select all indicators from the table\r\n| where TimeGenerated < now()\r\n// Select only indicators that have not expired\r\n and ValidUntil > now()\r\n// Select only indicators that are marked active\r\n and IsActive == true\r\n// Select only the most recently ingested copy of an indicator\r\n| summarize arg_max(TimeGenerated, *) by Id\r\n// Create a new column to identify the type of indicator, IP, Domain, URL, File, or Other\r\n| extend IndicatorType = iff(ObservableKey hasprefix \"network-traffic\", \"IP\", iff(ObservableKey hasprefix \"file\" or ObservableKey hasprefix \"x509-certificate\", \"File\", iff(ObservableKey hasprefix \"domain-name\", \"Domain\", iff(ObservableKey hasprefix \"email-addr\", \"Email\", iff(ObservableKey hasprefix \"url\", \"URL\", \"Other\")))))\r\n// Summarize and order the data, then render the chart\r\n| summarize CountOfIndicators = count() by IndicatorType\r\n| order by CountOfIndicators desc \r\n| render barchart kind=unstacked",
"size": 0,
"showAnalytics": true,
"title": "Active Indicators by Indicator Type",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
]
},
"name": "query - TIByType"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicators\r\n//| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n| summarize Count = count() by SourceSystem, bin(TimeGenerated, 1d)",
"size": 0,
"showAnnotations": true,
"title": "Threat Indicators Ingested by Source in the {TimeRange:label}",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart",
"chartSettings": {
"showLegend": true
}
},
"name": "query - indicators over time"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "ThreatIntelIndicators\r\n// Select all indicators from the table\r\n| where TimeGenerated < now()\r\n// Select only indicators that have not expired\r\n and ValidUntil > now()\r\n// Select only indicators that are marked active\r\n and IsActive == true\r\n// Select only the most recently ingested copy of an indicator\r\n| summarize arg_max(TimeGenerated, *) by Id\r\n// Summarize and order the data, then render the chart\r\n| summarize CountOfIndicators = count() by tostring(Confidence)\r\n| order by CountOfIndicators desc \r\n| render piechart",
"size": 0,
"showAnalytics": true,
"title": "Active Indicators by Confidence Score",
"timeContextFromParameter": "TimeRange",
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
]
},
"name": "query - TIByScore"
}
]
},
"customWidth": "70",
"name": "group - Threat Intelligence Indicators Sources"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Threat Intelligence Indicators ###\r\n\r\nCyber threat intelligence (CTI) is information describing existing or potential threats to systems and users. For SIEM solutions like Microsoft Sentinel, the most common forms of CTI are threat indicators, also known as Indicators of Compromise (IoC) or Indicators of Attack (IoA). \r\n\r\nThreat indicators are data that associate observed artifacts such as URLs, file hashes, or IP addresses with known threat activity such as phishing, botnets, or malware. Use threat indicators in Microsoft Sentinel, to detect malicious activity observed in your environment and provide context to security investigators to inform response decisions.\r\n\r\nMicrosoft Sentinel provides different options for you to bring your TI data into your workspace:\r\n\r\n1.\tMicrosoft Defender Threat Intelligence Analytics rule is a built in rule that matches indicators with event logs from Common Event Format (CEF) logs, Syslog, Windows DNS, Office activity and Azure activity logs. Review [Use matching analytics to detect threats](https://learn.microsoft.com/azure/sentinel/use-matching-analytics-to-detect-threats) to understand how to use the rule. \r\n\r\n2.\tUse the Mirosoft Defender Threat Intelligence data connector is available for Sentinel customers to ingest high fidelity IOCs at no cost. Details to set it up [Enable data connector for Microsoft's threat intelligence - Microsoft Defender Threat Intelligence](https://learn.microsoft.com/en-us/azure/sentinel/connect-mdti-data-connector#install-the-threat-intelligence-solution-in-microsoft-sentinel) \r\n\r\n3.\tUse the threat intelligence upload API which is a new data plane API that requires less permissions to deploy, operates at a per workspace level and follows STIX schema. [Connect your threat intelligence platform with upload indicators API - Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/connect-threat-intelligence-upload-api)\r\n\r\n4.\tUse the TAXII connector to ingest IOCs from TAXII servers. [Connect Microsoft Sentinel to STIX/TAXII threat intelligence feeds](https://learn.microsoft.com/azure/sentinel/connect-threat-intelligence-taxii)\r\n\r\n5.\tAdd indicators from a CSV or JSON file using bulk upload as described here [Add indicators in bulk to threat intelligence by file - Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/indicators-bulk-file-import)\r\n\r\nOnce the IOCs are in your Microsoft Sentinel wrokspace, you can:\r\n\r\nUse the TI blade to view and manage the IOCs. You can view the IOCs information such as confidence levels, tags, threat types. IP and domain name indicators are also enriched with extra GeoLocation and WhoIs data, providing more context for investigations where the selected indicator is found.\r\n\r\nYou can tag and edit the IOC in the Threat Intelligence blade to make it easier to find them.[Work with threat indicators in Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/work-with-threat-indicators#tag-and-edit-threat-indicators). You can also add IOCs directly to the Threat Intelligence blade or add an entity that you have idetnfied as malicious during your investigation. \r\n\r\nOnce added, the entity can be used for detection, hunting across your Microsoft Sentinel workspace. More details here [Add entities to threat intelligence in Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/add-entity-to-threat-intelligence?tabs=incidents)\r\n\r\nYou can use the IoCs in analytic rules. There are several analytic rules templates that you can customize or enable to match any IP events to the threat indicators. Look out for the ***TI map... analytics rules*** [Use threat indicators in analytics rules - Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/use-threat-indicators-in-analytics-rules)\r\n\r\n\r\n\r\n",
"style": "upsell"
},
"name": "text - 0"
}
]
},
"customWidth": "30",
"name": "group - ThreatIntelligence Insights"
}
]
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "3"
},
"name": "group - Threat Intelligence Indicators",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Watchlists",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print Watchlist = \"{WatchlistAPI}\"\r\n| extend Watchlist = substring(Watchlist, 1,strlen(Watchlist)-2)\r\n| project Watchlist_Table=split(Watchlist, ',')\r\n| mv-expand Watchlist_Table\r\n| where isnotempty(Watchlist_Table)\r\n| extend Watchlist_Table = trim(\" \",tostring(Watchlist_Table))\r\n| count\r\n| extend Title = \"Total Watchlists\"\r\n| extend Text1 = \"in {Workspace:Label} workspace\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": 0,
"palette": "magenta"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"name": "query-Tile-WatchlistCount"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourcegroups/{Workspace:resourcegroup}/providers/microsoft.operationalinsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/watchlists?api-version=2023-02-01\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value[*]\",\"columns\":[{\"path\":\"name\",\"columnid\":\"WatchlistAlias\",\"columnType\":\"string\"},{\"path\":\"properties.source\",\"columnid\":\"WatchlistSource\"},{\"path\":\"systemData.createdBy\",\"columnid\":\"CreatedBy\"},{\"path\":\"systemData.createdAt\",\"columnid\":\"CreatedAt\"},{\"path\":\"systemData.lastModifiedAt\",\"columnid\":\"LastModifiedAt\"},{\"path\":\"systemData.lastModifiedBy\",\"columnid\":\"LastModifiedBy\"},{\"path\":\"properties.itemsSearchKey\",\"columnid\":\"SearchKey\"}]}}]}",
"size": 2,
"title": "Watchlists in '{Workspace:name}' workspace",
"exportFieldName": "WatchlistAlias",
"exportParameterName": "WatchlistAlias",
"queryType": 12,
"gridSettings": {
"formatters": [
{
"columnMatch": "WatchlistAlias",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "40ch"
}
},
{
"columnMatch": "WatchlistSource",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "40ch"
}
},
{
"columnMatch": "CreatedBy",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "35ch"
}
},
{
"columnMatch": "CreatedAt",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "23ch"
}
},
{
"columnMatch": "LastModifiedAt",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "23ch"
}
},
{
"columnMatch": "LastModifiedBy",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "35ch"
}
},
{
"columnMatch": "SearchKey",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "16ch"
}
}
],
"rowLimit": 10000,
"filter": true,
"sortBy": [
{
"itemKey": "WatchlistAlias",
"sortOrder": 1
}
]
},
"sortBy": [
{
"itemKey": "WatchlistAlias",
"sortOrder": 1
}
]
},
"customWidth": "99",
"name": "query - GetWatchlists"
},
{
"type": 1,
"content": {
"json": "#### Select a Watchlist from the table above to view the watchlist items. ####",
"style": "info"
},
"conditionalVisibility": {
"parameterName": "WatchlistAlias",
"comparison": "isEqualTo"
},
"name": "text - selectWatchlist items"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_GetWatchlist('{WatchlistAlias}')",
"size": 2,
"title": "Watchlist Items",
"timeContext": {
"durationMs": 86400000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "LastUpdatedTimeUTC",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "25ch"
}
}
],
"rowLimit": 10000,
"filter": true
}
},
"customWidth": "99",
"conditionalVisibility": {
"parameterName": "WatchlistAlias",
"comparison": "isNotEqualTo"
},
"name": "query - GetWatchlistItems"
}
]
},
"customWidth": "70",
"name": "group - WatchLists Chart"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Watchlists ###\r\n\r\nWatchlists in Microsoft Sentinel allow you to correlate contextual information with the events in your Microsoft Sentinel environment. For example, you might create a watchlist with a list of high value assets, terminated employees, or service accounts in your environment. The list can be made by uploading a CSV file of data or made via the Microsoft Sentinel API.\r\n\r\n#### **Use cases:**\r\n\r\nUse watchlists to help you with following scenarios:\r\n\r\n- **Investigate threats** and respond to incidents quickly with the rapid import of IP addresses, file hashes, and other data from CSV files. After you import the data, use watchlist name-value pairs for joins and filters in alert rules, threat hunting, workbooks, notebooks, and general queries.\r\n\r\n- **Import business data** as a watchlist. For example, import user lists with privileged system access, or terminated employees. Then, use the watchlist to create allowlists and blocklists to detect or prevent those users from logging in to the network.\r\n\r\n- **Reduce alert fatigue.** Create allowlists to suppress alerts from a group of users, such as users from authorized IP addresses that perform tasks that would normally trigger the alert. Prevent benign events from becoming alerts.\r\n\r\n- **Enrich event data.** Use watchlists to enrich your event data with name-value combinations derived from external data sources.\r\n\r\n- **In search queries**, Watchlists can be referenced as a table for joins and lookups. [Build queries or rules with watchlists](https://learn.microsoft.com/en-us/azure/sentinel/watchlists-queries#build-queries-with-watchlists)\r\n\r\n- **In detection rules**, you can exclude or include events in a Watchlist [Build queries or rules with watchlists](https://learn.microsoft.com/en-us/azure/sentinel/watchlists-queries#build-queries-with-watchlists). To modify the KQL to handle exceptions, follow these steps [Use Watchlists to handle false positives](https://learn.microsoft.com/en-us/azure/sentinel/false-positives#use-watchlists-to-manage-exceptions)\r\n\r\nTo create a Watchlist, you can upload a file from a local folder as explained here [Create watchlists](https://learn.microsoft.com/en-us/azure/sentinel/watchlists-create#upload-a-watchlist-from-a-local-folder). The file size is limited to **3.8MB**. For larger files, upload the file to your Azure Storage account, then create a shared access signature URL for Microsoft Sentinel to retrieve the watchlist data. [Create watchlists](https://learn.microsoft.com/en-us/azure/sentinel/watchlists-create#create-a-large-watchlist-from-file-in-azure-storage-preview). The file size is limited to ** 500MB **.\r\n\r\nTo update Watchlist, you can update a [single item](https://learn.microsoft.com/en-us/azure/sentinel/watchlists-manage#edit-a-watchlist-item) or use [bulk update](https://learn.microsoft.com/en-us/azure/sentinel/watchlists-manage#bulk-update-a-watchlist) to add several items to your Watchlist. You can also use playbooks to dynamically update Watchlists as described in this [blogpost](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/new-watchlist-actions-available-for-watchlist-automation-using/ba-p/3297851)\r\n\r\nLimitations for Watchlists include not supporting cross-workspace scenarios, limitations on the file size. More details here [Limitations](https://learn.microsoft.com/en-us/azure/sentinel/watchlists#limitations-of-watchlists)",
"style": "upsell"
},
"name": "text - 1"
}
]
},
"customWidth": "30",
"name": "group - Watchlists Insights"
}
]
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "3"
},
"name": "Watchlists",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Analytics Rules",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": " ",
"items": [
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "afb202f0-3f02-42eb-9ddc-9a9936a2e0c7",
"version": "KqlParameterItem/1.0",
"name": "ActiveRulesTactics",
"type": 1,
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourcegroups/{Workspace:resourcegroup}/providers/microsoft.operationalinsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/alertRules?api-version=2023-06-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value[?(@.kind==\\\"NRT\\\" || @.kind==\\\"Scheduled\\\")]\",\"columns\":[{\"path\":\"properties.tactics\",\"columnid\":\"Tactic\"}]}}]}",
"isHiddenWhenLocked": true,
"timeContext": {
"durationMs": 86400000
},
"queryType": 12
},
{
"version": "KqlParameterItem/1.0",
"name": "ActiveRulesKind",
"type": 1,
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourcegroups/{Workspace:resourcegroup}/providers/microsoft.operationalinsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/alertRules?api-version=2023-06-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[{\"path\":\"kind\",\"columnid\":\"Kind\"}]}}]}",
"isHiddenWhenLocked": true,
"timeContext": {
"durationMs": 86400000
},
"queryType": 12,
"id": "ec62827e-b319-4608-88c2-80c707569057"
}
],
"style": "pills",
"queryType": 12
},
"name": "parameters - Analytics"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print ActiveAnalytics = \"{ActiveAnalytics}\"\r\n| extend ActiveAnalytics = substring(ActiveAnalytics, 1,strlen(ActiveAnalytics)-2)\r\n| project ActiveAnalytics_Table=split(ActiveAnalytics, ',')\r\n| mv-expand ActiveAnalytics_Table\r\n| extend ActiveAnalytics_Table = trim(\" \",tostring(ActiveAnalytics_Table))\r\n| summarize count() by ActiveAnalytics_Table\r\n",
"size": 0,
"title": "Active Rule Count by Enabled Status",
"timeContext": {
"durationMs": 86400000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "piechart",
"chartSettings": {
"seriesLabelSettings": [
{
"seriesName": "false",
"color": "red"
},
{
"seriesName": "true",
"color": "green"
}
]
}
},
"customWidth": "45",
"name": "query - ActiveRules"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print ActiveRulesKind = \"{ActiveRulesKind}\"\r\n| extend ActiveRulesKind = substring(ActiveRulesKind, 1,strlen(ActiveRulesKind)-2)\r\n| project ActiveRulesKind_Table=split(ActiveRulesKind, ',')\r\n| mv-expand ActiveRulesKind_Table\r\n| extend ActiveRulesKind_Table = trim(\" \",tostring(ActiveRulesKind_Table))\r\n| summarize Count=count() by ActiveRulesKind_Table\r\n\r\n",
"size": 0,
"title": "Active Rule Count by Rule Type",
"timeContext": {
"durationMs": 86400000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "piechart",
"chartSettings": {
"seriesLabelSettings": [
{
"seriesName": "false",
"color": "red"
},
{
"seriesName": "true",
"color": "green"
}
]
}
},
"customWidth": "55",
"name": "query - ActiveRulesByKind"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print ActiveRulesTactics = tostring('{ActiveRulesTactics}')\r\n| extend ActiveRulesTactics = substring(ActiveRulesTactics, 1,strlen(ActiveRulesTactics)-2)\r\n| project ActiveRulesTactics_Table=split(ActiveRulesTactics, ', ')\r\n| mv-expand ActiveRulesTactics_Table \r\n| where isnotempty(ActiveRulesTactics_Table)\r\n| where tostring(ActiveRulesTactics_Table) != \"[]\"\r\n| extend ActiveRulesTactics_Table=todynamic(trim(\" \", tostring(ActiveRulesTactics_Table)))\r\n| mv-expand (ActiveRulesTactics_Table)\r\n| summarize RuleCount=count() by tostring(ActiveRulesTactics_Table)\r\n\r\n",
"size": 2,
"title": "Active Rule Count by Tactic",
"timeContext": {
"durationMs": 86400000
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "graph",
"graphSettings": {
"type": 2,
"topContent": {
"columnMatch": "ActiveRulesTactics_Table"
},
"centerContent": {
"columnMatch": "RuleCount",
"formatter": 12,
"formatOptions": {
"palette": "gray"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"useGrouping": false
}
}
},
"nodeIdField": "ActiveRulesTactics_Table",
"sourceIdField": "rn",
"targetIdField": "TacticCount",
"graphOrientation": 3,
"showOrientationToggles": false,
"nodeSize": null,
"staticNodeSize": 75,
"colorSettings": {
"nodeColorField": "RuleCount",
"type": 1,
"colorPalette": "pastel"
},
"hivesMargin": 6
},
"chartSettings": {
"seriesLabelSettings": [
{
"seriesName": "false",
"color": "red"
},
{
"seriesName": "true",
"color": "green"
}
]
}
},
"name": "query - ActiveRulesByTactics"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourcegroups/{Workspace:resourcegroup}/providers/microsoft.operationalinsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/alertRules?api-version=2023-06-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$..value[?(@.properties.tactics==\\\"\\\" || @.properties.techniques== \\\"\\\" && (@.kind==\\\"Scheduled\\\" || @.kind== \\\"NRT\\\"))]\",\"columns\":[{\"path\":\"properties.displayName\",\"columnid\":\"AnalyticsRuleName\"},{\"path\":\"kind\",\"columnid\":\"RuleType\"},{\"path\":\"properties.enabled\",\"columnid\":\"Enabled\"},{\"path\":\"properties.severity\",\"columnid\":\"Severity\"},{\"path\":\"properties.tactics\",\"columnid\":\"Tactics\"},{\"path\":\"properties.techniques\",\"columnid\":\"Techniques\"},{\"path\":\"properties.query\",\"columnid\":\"Query\"},{\"path\":\"properties.lastModifiedUtc\",\"columnid\":\"LastModifiedAt\"}]}}]}",
"size": 0,
"title": "Active Analytics Rules without Tactics or Techniques, count: {$rowCount}",
"queryType": 12,
"gridSettings": {
"formatters": [
{
"columnMatch": "RuleType",
"formatter": 1,
"formatOptions": {
"customColumnWidthSetting": "16ch"
}
},
{
"columnMatch": "Enabled",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "true",
"representation": "success",
"text": "true"
},
{
"operator": "==",
"thresholdValue": "false",
"representation": "stopped",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "Blank",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "14ch"
}
},
{
"columnMatch": "Severity",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "High",
"representation": "Sev0",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Medium",
"representation": "Sev1",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Low",
"representation": "Sev2",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Informational",
"representation": "Sev3",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "Blank",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "17ch"
}
},
{
"columnMatch": "Tactics",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "25ch"
}
},
{
"columnMatch": "Techniques",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "22ch"
}
},
{
"columnMatch": "Query",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkLabel": "📋",
"linkIsContextBlade": true,
"customColumnWidthSetting": "11ch"
}
},
{
"columnMatch": "LastModifiedAt",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "24ch"
}
}
],
"rowLimit": 2500,
"filter": true,
"sortBy": [
{
"itemKey": "AnalyticsRuleName",
"sortOrder": 1
}
]
},
"sortBy": [
{
"itemKey": "AnalyticsRuleName",
"sortOrder": 1
}
]
},
"customWidth": "99",
"name": "query - Analytics Rules without Tactics or Techniques"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourcegroups/{Workspace:resourcegroup}/providers/microsoft.operationalinsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/alertRules?api-version=2023-06-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value[*]\",\"columns\":[{\"path\":\"properties.displayName\",\"columnid\":\"AnalyticsRuleName\"},{\"path\":\"kind\",\"columnid\":\"RuleType\"},{\"path\":\"properties.enabled\",\"columnid\":\"Enabled\"},{\"path\":\"properties.severity\",\"columnid\":\"Severity\"},{\"path\":\"properties.tactics\",\"columnid\":\"Tactics\"},{\"path\":\"properties.techniques\",\"columnid\":\"Techniques\"},{\"path\":\"properties.query\",\"columnid\":\"Query\"},{\"path\":\"properties.lastModifiedUtc\",\"columnid\":\"LastModifiedAt\"}]}}]}",
"size": 2,
"title": "Active Analytics Rules (Enabled & Disabled) , count: {$rowCount}",
"queryType": 12,
"gridSettings": {
"formatters": [
{
"columnMatch": "RuleType",
"formatter": 1,
"formatOptions": {
"customColumnWidthSetting": "30ch"
}
},
{
"columnMatch": "Enabled",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "true",
"representation": "success",
"text": "true"
},
{
"operator": "==",
"thresholdValue": "false",
"representation": "stopped",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "Blank",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "14ch"
}
},
{
"columnMatch": "Severity",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "High",
"representation": "Sev0",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Medium",
"representation": "Sev1",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Low",
"representation": "Sev2",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Informational",
"representation": "Sev3",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "Blank",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "17ch"
}
},
{
"columnMatch": "Tactics",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "48ch"
}
},
{
"columnMatch": "Techniques",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "22ch"
}
},
{
"columnMatch": "Query",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkLabel": "📋",
"linkIsContextBlade": true,
"customColumnWidthSetting": "11ch"
}
},
{
"columnMatch": "LastModifiedAt",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "24ch"
}
}
],
"rowLimit": 2500,
"filter": true,
"sortBy": [
{
"itemKey": "Tactics",
"sortOrder": 1
}
]
},
"sortBy": [
{
"itemKey": "Tactics",
"sortOrder": 1
}
]
},
"customWidth": "99",
"name": "query - Analytics Rules Mapped to MITRE ATT&CK Framework"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_SentinelHealth()\r\n| where SentinelResourceType == \"Analytics Rule\"\r\n|summarize Success=count(Status=='Success'), Failure=count(Status=='Failure'),PartialSuccess=count(Status=='Partial success') by SentinelResourceName, SentinelResourceId\r\n| order by SentinelResourceName asc\r\n",
"size": 0,
"title": " Analytics Rules Run Status, from: {TimeRange:label}",
"timeContextFromParameter": "TimeRange",
"exportedParameters": [
{
"fieldName": "SentinelResourceId",
"parameterName": "SentinelResourceId",
"parameterType": 1
},
{
"fieldName": "SentinelResourceName",
"parameterName": "SentinelResourceName",
"parameterType": 1
}
],
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "SentinelResourceName",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "90ch"
}
},
{
"columnMatch": "SentinelResourceId",
"formatter": 5
},
{
"columnMatch": "Success",
"formatter": 8,
"formatOptions": {
"min": -5000,
"palette": "green",
"customColumnWidthSetting": "17ch"
}
},
{
"columnMatch": "Failure",
"formatter": 8,
"formatOptions": {
"min": -500,
"palette": "red",
"customColumnWidthSetting": "17ch"
}
},
{
"columnMatch": "PartialSuccess",
"formatter": 8,
"formatOptions": {
"min": -500000,
"max": 500000,
"palette": "orange",
"customColumnWidthSetting": "17ch"
}
}
],
"rowLimit": 10000,
"filter": true,
"sortBy": [
{
"itemKey": "$gen_heatmap_PartialSuccess_4",
"sortOrder": 2
}
],
"labelSettings": [
{
"columnId": "SentinelResourceName",
"label": "Rule Name"
}
]
},
"sortBy": [
{
"itemKey": "$gen_heatmap_PartialSuccess_4",
"sortOrder": 2
}
]
},
"customWidth": "99",
"name": "query - Analytics Rules Run Status"
},
{
"type": 1,
"content": {
"json": "Select a rule in the table above to view the rule run details",
"style": "info"
},
"conditionalVisibilities": [
{
"parameterName": "Help",
"comparison": "isEqualTo",
"value": "Yes"
},
{
"parameterName": "SentinelResourceId",
"comparison": "isEqualTo"
}
],
"name": "text-AnalyticsRuleRun"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "_SentinelHealth()\r\n| where SentinelResourceType == \"Analytics Rule\"\r\n| where SentinelResourceId == \"{SentinelResourceId}\"\r\n| project TimeGenerated, SentinelResourceName, Status, Description, Reason, ExtendedProperties\r\n| order by TimeGenerated desc\r\n\r\n",
"size": 0,
"title": "Analytic Rule run details for \"{SentinelResourceName}\"",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"gridSettings": {
"formatters": [
{
"columnMatch": "TimeGenerated",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "22ch"
}
},
{
"columnMatch": "Status",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "Success",
"representation": "success",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Failure",
"representation": "failed",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Partial success",
"representation": "2",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "Blank",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "12ch"
}
},
{
"columnMatch": "ExtendedProperties",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkLabel": "📋",
"linkIsContextBlade": true,
"customColumnWidthSetting": "22ch"
}
}
],
"rowLimit": 10000,
"filter": true,
"labelSettings": [
{
"columnId": "SentinelResourceName",
"label": "Analytic Rule Name"
}
]
}
},
"customWidth": "99",
"conditionalVisibility": {
"parameterName": "SentinelResourceId",
"comparison": "isNotEqualTo"
},
"name": "query-AnalyticRulebyStatus"
}
]
},
"customWidth": "70",
"name": "group - Analytic Rules"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Analytics Rules ###\r\n\r\nThe visualizations on the left provide details on the active rules in your environment (e.g., rules by enabled vs. disabled, rule type, and tactic).\r\n\r\nReview the following topics related to Analytics rules for best practices and recommendations:\r\n\r\n**MITRE ATT&CK Coverage**\r\n\r\nMITRE ATT&CK is a publicly accessible knowledge base of tactics and techniques that are commonly used by attackers and is created and maintained by observing real-world observations. Organizations use the MITRE ATT&CK framework to verify the security coverage and status in their environments.\r\n\r\nThe analytic rules templates and hunting queries provided out of box all have MITRE techniques applied. If you add custom rules and hunting queries, ensure you apply MITRE techniques to them. Incidents generated from the analytic rules will also have the MITRE techniques.\r\nYou can view your analytic rules coverage in this section and identify gaps that are not covered. \r\n\r\nThe MITRE ATT&CK blade gives a very detailed view of the analytic rules and hunting queries deployed in your Sentinel workspace and shows where you have little or no coverage. It also allows you to simulate your coverage for different techniques and will show the analytic rules that you would need to deploy. [Check your MITRE coverage in the Microsoft Sentinel MITRE page](https://learn.microsoft.com/azure/sentinel/mitre-coverage) to understand your organization's security coverage, based on the tactics and techniques from the MITRE ATT&CK® framework.\r\n\r\n**Analytics Rules Health**\r\n\r\nYou can monitor the health of your analytic rules by using the new health and auditing monitoring capabilities. You need to enable health and auditing monitoring [Turn on auditing and health monitoring in Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/enable-monitoring) . \r\n\r\nOnce enabled the SentinelHealth table will contain information of your analytic rules, if they ran successfully, if they failed and why the rule failed, if the alert threshold was met. Review [Monitor the health and audit the integrity of your Microsoft Sentinel analytics rules](https://learn.microsoft.com/en-us/azure/sentinel/monitor-analytics-rule-integrity) for more details \r\n\r\n**Execution Management**\r\n\r\nThe [Execution Management](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-monitor-and-optimize-the-execution-of-your-scheduled/ba-p/3864083) for scheduled Analytics rules offers two new capabilities – built-in schedule rule insights and re-run scheduled rules on-demand.\r\n\r\nThe Analytics rule **Insights** panel provides further information related to a rule, such as failed executions, top health issues, the count of alert over time and the closed classification of the incidents triggered by the rule. These insights assist security analysts in identifying potential issues or misconfigurations with analytics rules, troubleshooting rule failures, and optimizing rule configurations for improved performance and accuracy.\r\n\r\nThe ability to **re-run** analytics rules on-demand in Microsoft Sentinel offers flexibility and control when validating rule effectiveness. This capability proves beneficial in various scenarios, including rule refinement, testing, validation, and more. \r\n\r\n** Tuning Insights and Recommendations **\r\n\r\nBased on your incident review, check whether your analytics rules are triggered as expected, and whether the rules reflect the types of incidents you're interested in.\r\n\r\n[Handle false positives](https://learn.microsoft.com/azure/sentinel/false-positives), either by using automation or by modifying scheduled analytics rules.\r\n\r\nMicrosoft Sentinel provides built-in fine-tuning capabilities to help you analyze your analytics rules. [Review these built-in insights and implement relevant recommendations](https://learn.microsoft.com/azure/sentinel/detection-tuning).",
"style": "upsell"
},
"name": "text - 27"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "paragraph",
"links": [
{
"id": "1ab80430-1f91-42c9-ba1c-d688bdcf61e0",
"linkTarget": "OpenBlade",
"linkLabel": "Open Analytics Blade",
"style": "primary",
"bladeOpenContext": {
"bladeName": "AnalyticsPage.ReactView",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": [
{
"name": "subscriptionId",
"source": "static",
"value": "{Workspace:subscriptionId}"
},
{
"name": "resourceGroup",
"source": "static",
"value": "{Workspace:resourceGroup}"
},
{
"name": "workspaceName",
"source": "static",
"value": "{Workspace:name}"
}
]
}
},
{
"id": "c124f1e5-37cc-4fe7-83b7-6cecc5e848d7",
"linkTarget": "OpenBlade",
"linkLabel": "Open MITRE Blade",
"style": "primary",
"bladeOpenContext": {
"bladeName": "MitrePage.ReactView",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": [
{
"name": "workspace",
"source": "static",
"value": "{Workspace:id}"
},
{
"name": "subscriptionId",
"source": "static",
"value": "{Workspace:subscriptionId}"
},
{
"name": "resourceGroup",
"source": "static",
"value": "{Workspace:resourceGroup}"
},
{
"name": "workspaceName",
"source": "static",
"value": "{Workspace:name}"
}
]
}
}
]
},
"name": "links - Analytics"
}
]
},
"customWidth": "30",
"name": "group - AnalyticRulesInsights"
}
]
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "3"
},
"name": "group - Analytics Rules",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Data value optimization",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print SOCRecommendation = parse_json(dynamic({SOCOptimizationDataValue}))\r\n| extend SOCRecommendation = iif(tostring(SOCRecommendation) startswith \"[\",SOCRecommendation,todynamic(strcat(\"[\",tostring(SOCRecommendation), \"]\")))\r\n| mv-expand SOCRecommendation\r\n| evaluate bag_unpack(SOCRecommendation)\r\n| where state == \"Active\"\r\n| count\r\n| extend Title = \"Active\"\r\n| extend Text1 = \"in {Workspace:Label} workspace\"\r\n//| extend Text2 = \"Optimization(s)\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"sortBy": [],
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "turquoise"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"rightContent": {
"columnMatch": "Text2"
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "20",
"name": "query-DataValueActiveTile"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print SOCRecommendation = parse_json(dynamic({SOCOptimizationDataValue}))\r\n| extend SOCRecommendation = iif(tostring(SOCRecommendation) startswith \"[\",SOCRecommendation,todynamic(strcat(\"[\",tostring(SOCRecommendation), \"]\")))\r\n| mv-expand SOCRecommendation\r\n| evaluate bag_unpack(SOCRecommendation)\r\n| where state == \"InProgress\"\r\n| count\r\n| extend Title = \"In Progress\"\r\n| extend Text1 = \"in {Workspace:Label} workspace\"\r\n//| extend Text2 = \"Optimization(s)\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"sortBy": [],
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "blue"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"rightContent": {
"columnMatch": "Text2"
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "20",
"name": "query-DataValueInProgressTile"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print SOCRecommendation = parse_json(dynamic({SOCOptimizationDataValue}))\r\n| extend SOCRecommendation = iif(tostring(SOCRecommendation) startswith \"[\",SOCRecommendation,todynamic(strcat(\"[\",tostring(SOCRecommendation), \"]\")))\r\n| mv-expand SOCRecommendation\r\n| evaluate bag_unpack(SOCRecommendation)\r\n| where state == \"Dismissed\"\r\n| count\r\n| extend Title = \"Dismissed\"\r\n| extend Text1 = \"in {Workspace:Label} workspace\"\r\n//| extend Text2 = \"Optimization(s)\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"sortBy": [],
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "orange"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"rightContent": {
"columnMatch": "Text2"
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "20",
"name": "query-DataValueDismissedTile"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print SOCRecommendation = parse_json(dynamic({SOCOptimizationDataValue}))\r\n| extend SOCRecommendation = iif(tostring(SOCRecommendation) startswith \"[\",SOCRecommendation,todynamic(strcat(\"[\",tostring(SOCRecommendation), \"]\")))\r\n| mv-expand SOCRecommendation\r\n| evaluate bag_unpack(SOCRecommendation)\r\n| where state == \"CompletedByUser\"\r\n| count\r\n| extend Title = \"Completed By User\"\r\n| extend Text1 = \"in {Workspace:Label} workspace\"\r\n//| extend Text2 = \"Optimization(s)\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"sortBy": [],
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "green"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"rightContent": {
"columnMatch": "Text2"
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "20",
"name": "query-DataValueCompletedUserTile"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print SOCRecommendation = parse_json(dynamic({SOCOptimizationDataValue}))\r\n| extend SOCRecommendation = iif(tostring(SOCRecommendation) startswith \"[\",SOCRecommendation,todynamic(strcat(\"[\",tostring(SOCRecommendation), \"]\")))\r\n| mv-expand SOCRecommendation\r\n| evaluate bag_unpack(SOCRecommendation)\r\n| where state == \"CompletedBySystem\"\r\n| count\r\n| extend Title = \"Completed By System\"\r\n| extend Text1 = \"in {Workspace:Label} workspace\"\r\n//| extend Text2 = \"Optimization(s)\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"sortBy": [],
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "green"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"rightContent": {
"columnMatch": "Text2"
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "20",
"name": "query-DataValueCompletedSystemTile"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print SOCRecommendation = parse_json(dynamic({SOCOptimizationDataValue}))\r\n| extend SOCRecommendation = iif(tostring(SOCRecommendation) startswith \"[\",SOCRecommendation,todynamic(strcat(\"[\",tostring(SOCRecommendation), \"]\")))\r\n| mv-expand SOCRecommendation\r\n| evaluate bag_unpack(SOCRecommendation)\r\n| summarize count() by state\r\n",
"size": 0,
"title": "Data Value Optimization Summary",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "piechart",
"gridSettings": {
"formatters": [
{
"columnMatch": "State",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "Active",
"representation": "turquoise",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "InProgress",
"representation": "blue",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Dismissed",
"representation": "orange",
"text": "{0}{1}"
},
{
"operator": "contains",
"thresholdValue": "Completed",
"representation": "green",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "lightBlue",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "20ch"
}
},
{
"columnMatch": "TableName",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "28ch"
}
},
{
"columnMatch": "CreatedTimeUtc",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "28ch"
}
},
{
"columnMatch": "LastEvaluatedTimeUtc",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "28ch"
}
},
{
"columnMatch": "LastModifiedTimeUtc",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "28ch"
}
},
{
"columnMatch": "Recommendations",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
}
}
],
"filter": true
},
"sortBy": [],
"graphSettings": {
"type": 0,
"topContent": {
"columnMatch": "state",
"formatter": 1
},
"centerContent": {
"columnMatch": "Count",
"formatter": 1,
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
}
},
"chartSettings": {
"seriesLabelSettings": [
{
"seriesName": "Active",
"color": "turquoise"
},
{
"seriesName": "CompletedBySystem",
"color": "green"
},
{
"seriesName": "Dismissed",
"color": "orange"
},
{
"seriesName": "InProgress",
"color": "blue"
},
{
"seriesName": "CompletedByUser",
"color": "green"
}
]
},
"mapSettings": {
"locInfo": "LatLong",
"sizeSettings": "Count",
"sizeAggregation": "Sum",
"legendMetric": "Count",
"legendAggregation": "Sum",
"itemColorSettings": {
"type": "heatmap",
"colorAggregation": "Sum",
"nodeColorField": "Count",
"heatmapPalette": "greenRed"
}
}
},
"customWidth": "95",
"name": "query-DataValueOptimizationPie"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "a0a0dd9b-7e21-4680-9c12-5858c529b1ab",
"version": "KqlParameterItem/1.0",
"name": "DataValueState",
"label": "State",
"type": 2,
"multiSelect": true,
"quote": "'",
"delimiter": ",",
"query": "print SOCRecommendation = parse_json(dynamic({SOCOptimizationDataValue}))\r\n| extend SOCRecommendation = iif(tostring(SOCRecommendation) startswith \"[\",SOCRecommendation,todynamic(strcat(\"[\",tostring(SOCRecommendation), \"]\")))\r\n| mv-expand SOCRecommendation\r\n| evaluate bag_unpack(SOCRecommendation)\r\n| distinct state",
"typeSettings": {
"additionalResourceOptions": [
"value::all"
],
"showDefault": false
},
"timeContext": {
"durationMs": 86400000
},
"defaultValue": "value::all",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"value": [
"value::all"
]
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - DataValueOptimization"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print SOCRecommendation = parse_json(dynamic({SOCOptimizationDataValue}))\r\n| extend SOCRecommendation = iif(tostring(SOCRecommendation) startswith \"[\",SOCRecommendation,todynamic(strcat(\"[\",tostring(SOCRecommendation), \"]\")))\r\n| mv-expand SOCRecommendation\r\n| evaluate bag_unpack(SOCRecommendation)\r\n| evaluate bag_unpack(additionalProperties)\r\n| where state in ({DataValueState})\r\n| order by state\r\n| project State = state, TableName, Title=[\"title\"], Description = description, CreatedTimeUtc = creationTimeUtc,LastEvaluatedTimeUtc=lastEvaluatedTimeUtc,LastModifiedTimeUtc=lastModifiedTimeUtc, Suggestions =suggestions\r\n//| summarize Count = count() by state,[\"title\"], bin(creationTimeUtc, 1d), bin(lastModifiedTimeUtc, 1d)",
"size": 0,
"title": "Data Value Optimization Details",
"timeContextFromParameter": "TimeRange",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "State",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "Active",
"representation": "turquoise",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "InProgress",
"representation": "blue",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Dismissed",
"representation": "orange",
"text": "{0}{1}"
},
{
"operator": "contains",
"thresholdValue": "Completed",
"representation": "green",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "lightBlue",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "20ch"
}
},
{
"columnMatch": "TableName",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "25ch"
}
},
{
"columnMatch": "Title",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "48ch"
}
},
{
"columnMatch": "Description",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "44ch"
}
},
{
"columnMatch": "CreatedTimeUtc",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "26ch"
}
},
{
"columnMatch": "LastEvaluatedTimeUtc",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "26ch"
}
},
{
"columnMatch": "LastModifiedTimeUtc",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "26ch"
}
},
{
"columnMatch": "Suggestions",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkLabel": "📋",
"linkIsContextBlade": true,
"customColumnWidthSetting": "16ch"
}
}
],
"filter": true
},
"sortBy": [],
"graphSettings": {
"type": 0,
"topContent": {
"columnMatch": "state",
"formatter": 1
},
"centerContent": {
"columnMatch": "Count",
"formatter": 1,
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
}
},
"mapSettings": {
"locInfo": "LatLong",
"sizeSettings": "Count",
"sizeAggregation": "Sum",
"legendMetric": "Count",
"legendAggregation": "Sum",
"itemColorSettings": {
"type": "heatmap",
"colorAggregation": "Sum",
"nodeColorField": "Count",
"heatmapPalette": "greenRed"
}
}
},
"customWidth": "95",
"name": "query-DataValueOptimizationList"
}
]
},
"customWidth": "70",
"name": "Content"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Data value optimization\r\n[SOC optimization](https://learn.microsoft.com/azure/sentinel/soc-optimization/soc-optimization-access?tabs=azure-portal) provides actionable recommendations to enhance security controls and maximize the value of Microsoft security services over time. \r\n\r\nThese recommendations are tailored to your environment and designed to identify cost-reduction opportunities without compromising SOC needs or coverage. They also assist in addressing coverage gaps against specific threats and refining ingestion rates for data lacking security value, streamlining Microsoft Sentinel workspace optimization while saving SOC teams time on manual analysis and research.\r\n\r\n\r\n[Data value optimization](https://learn.microsoft.com/azure/sentinel/soc-optimization/soc-optimization-reference#data-value-optimizations) focuses on billable tables that have ingested data within the last 30 days, identifying underutilized data connectors or tables and offering recommendations to either reduce costs or enhance their value, based on your coverage.\r\n\r\n[Access the SOC optimization page](https://learn.microsoft.com/azure/sentinel/soc-optimization/soc-optimization-access?tabs=azure-portal#access-the-soc-optimization-page) to find out more.",
"style": "upsell"
},
"name": "text-AutomationUsed"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "paragraph",
"links": [
{
"id": "82cf504f-b72f-4b56-bd81-fff901b2c6de",
"linkTarget": "OpenBlade",
"linkLabel": "Open SOC Optimization",
"style": "primary",
"bladeOpenContext": {
"bladeName": "PrecisionPage.ReactView",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": [
{
"name": "subscriptionId",
"source": "static",
"value": "{Workspace:subscriptionId}"
},
{
"name": "resourceGroup",
"source": "static",
"value": "{Workspace:resourceGroup}"
},
{
"name": "workspaceName",
"source": "static",
"value": "{Workspace:name}"
}
]
}
}
]
},
"name": "links-AutomationUsed"
}
]
},
"customWidth": "30",
"name": "groupInsights-AutomationUsed"
}
]
},
"name": "DataValueOptimization",
"styleSettings": {
"showBorder": true
}
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"title": "Threat-based optimization",
"expandable": true,
"items": [
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print SOCRecommendation = dynamic('{SOCOptimizationCoverage}')\r\n| extend SOCRecommendation = substring(SOCRecommendation, 1,strlen(SOCRecommendation)-2)\r\n| project SOCRecommendation_Table=split(SOCRecommendation, ',')\r\n| mv-expand SOCRecommendation_Table\r\n| extend SOCRecommendation_Table = trim(\" \" ,tostring(SOCRecommendation_Table))\r\n| where SOCRecommendation_Table == \"Active\"\r\n| count\r\n| extend Title = \"Active\"\r\n| extend Text1 = \"in {Workspace:Label} workspace\"\r\n//| extend Text2 = \"Optimization(s)\"\r\n",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"sortBy": [],
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "turquoise"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"rightContent": {
"columnMatch": "Text2"
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "20",
"name": "query-CoverageActiveTile"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print SOCRecommendation = dynamic('{SOCOptimizationCoverage}')\r\n| extend SOCRecommendation = substring(SOCRecommendation, 1,strlen(SOCRecommendation)-2)\r\n| project SOCRecommendation_Table=split(SOCRecommendation, ',')\r\n| mv-expand SOCRecommendation_Table\r\n| extend SOCRecommendation_Table = trim(\" \" ,tostring(SOCRecommendation_Table))\r\n| where SOCRecommendation_Table == \"InProgress\"\r\n| count\r\n| extend Title = \"In Progress\"\r\n| extend Text1 = \"in {Workspace:Label} workspace\"\r\n//| extend Text2 = \"Optimization(s)\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"sortBy": [],
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "blue"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"rightContent": {
"columnMatch": "Text2"
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "20",
"name": "query-CoverageInProgressTile"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print SOCRecommendation = dynamic('{SOCOptimizationCoverage}')\r\n| extend SOCRecommendation = substring(SOCRecommendation, 1,strlen(SOCRecommendation)-2)\r\n| project SOCRecommendation_Table=split(SOCRecommendation, ',')\r\n| mv-expand SOCRecommendation_Table\r\n| extend SOCRecommendation_Table = trim(\" \" ,tostring(SOCRecommendation_Table))\r\n| where SOCRecommendation_Table == \"Dismissed\"\r\n| count\r\n| extend Title = \"Dismissed\"\r\n| extend Text1 = \"in {Workspace:Label} workspace\"\r\n//| extend Text2 = \"Optimization(s)\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"sortBy": [],
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "orange"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"rightContent": {
"columnMatch": "Text2"
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "20",
"name": "query-CoverageDismissedTile"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print SOCRecommendation = dynamic('{SOCOptimizationCoverage}')\r\n| extend SOCRecommendation = substring(SOCRecommendation, 1,strlen(SOCRecommendation)-2)\r\n| project SOCRecommendation_Table=split(SOCRecommendation, ',')\r\n| mv-expand SOCRecommendation_Table\r\n| extend SOCRecommendation_Table = trim(\" \" ,tostring(SOCRecommendation_Table))\r\n| where SOCRecommendation_Table == \"CompletedByUser\"\r\n| count\r\n| extend Title = \"Completed By User\"\r\n| extend Text1 = \"in {Workspace:Label} workspace\"\r\n//| extend Text2 = \"Optimization(s)\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"sortBy": [],
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "green"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"rightContent": {
"columnMatch": "Text2"
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "20",
"name": "query-CoverageCompletedUserTile"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print SOCRecommendation = dynamic('{SOCOptimizationCoverage}')\r\n| extend SOCRecommendation = substring(SOCRecommendation, 1,strlen(SOCRecommendation)-2)\r\n| project SOCRecommendation_Table=split(SOCRecommendation, ',')\r\n| mv-expand SOCRecommendation_Table\r\n| extend SOCRecommendation_Table = trim(\" \" ,tostring(SOCRecommendation_Table))\r\n| where SOCRecommendation_Table == \"CompletedBySystem\"\r\n| count\r\n| extend Title = \"Completed By System\"\r\n| extend Text1 = \"in {Workspace:Label} workspace\"\r\n//| extend Text2 = \"Optimization(s)\"",
"size": 4,
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "tiles",
"sortBy": [],
"tileSettings": {
"titleContent": {
"columnMatch": "Title",
"formatter": 1
},
"leftContent": {
"columnMatch": "Count",
"formatter": 12,
"formatOptions": {
"min": -1,
"palette": "green"
},
"numberFormat": {
"unit": 17,
"options": {
"style": "decimal",
"maximumFractionDigits": 2,
"maximumSignificantDigits": 3
}
}
},
"rightContent": {
"columnMatch": "Text2"
},
"secondaryContent": {
"columnMatch": "Text1"
},
"showBorder": false
}
},
"customWidth": "20",
"name": "query-CoverageCompletedSystemTile"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "print SOCRecommendation = dynamic('{SOCOptimizationCoverage}')\r\n| extend SOCRecommendation = substring(SOCRecommendation, 1,strlen(SOCRecommendation)-2)\r\n| project SOCRecommendation_Table=split(SOCRecommendation, ',')\r\n| mv-expand SOCRecommendation_Table\r\n| extend state = trim(\" \" ,tostring(SOCRecommendation_Table))\r\n| summarize count() by state\r\n",
"size": 0,
"title": "Coverage Optimization Summary",
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "piechart",
"gridSettings": {
"formatters": [
{
"columnMatch": "State",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "Active",
"representation": "turquoise",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "InProgress",
"representation": "blue",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Dismissed",
"representation": "orange",
"text": "{0}{1}"
},
{
"operator": "contains",
"thresholdValue": "Completed",
"representation": "green",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "lightBlue",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "20ch"
}
},
{
"columnMatch": "TableName",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "28ch"
}
},
{
"columnMatch": "CreatedTimeUtc",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "28ch"
}
},
{
"columnMatch": "LastEvaluatedTimeUtc",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "28ch"
}
},
{
"columnMatch": "LastModifiedTimeUtc",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "28ch"
}
},
{
"columnMatch": "Recommendations",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
}
}
],
"filter": true
},
"sortBy": [],
"graphSettings": {
"type": 0,
"topContent": {
"columnMatch": "state",
"formatter": 1
},
"centerContent": {
"columnMatch": "Count",
"formatter": 1,
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
}
},
"chartSettings": {
"seriesLabelSettings": [
{
"seriesName": "Active",
"color": "turquoise"
},
{
"seriesName": "CompletedBySystem",
"color": "green"
},
{
"seriesName": "Dismissed",
"color": "orange"
},
{
"seriesName": "InProgress",
"color": "blue"
},
{
"seriesName": "CompletedByUser",
"color": "green"
}
]
},
"mapSettings": {
"locInfo": "LatLong",
"sizeSettings": "Count",
"sizeAggregation": "Sum",
"legendMetric": "Count",
"legendAggregation": "Sum",
"itemColorSettings": {
"type": "heatmap",
"colorAggregation": "Sum",
"nodeColorField": "Count",
"heatmapPalette": "greenRed"
}
}
},
"customWidth": "95",
"name": "query-CoverageOptimizationPie"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"/subscriptions/{Subscription:id}/resourcegroups/{Workspace:resourcegroup}/providers/microsoft.operationalinsights/workspaces/{Workspace:name}/providers/Microsoft.SecurityInsights/recommendations?api-version=2024-01-01-preview\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value[?(@.properties.recommendationTypeId==\\\"Precision_Coverage\\\")]\",\"columns\":[{\"path\":\"properties.state\",\"columnid\":\"State\"},{\"path\":\"properties.additionalProperties.UseCaseName\",\"columnid\":\"UseCase\"},{\"path\":\"properties.title\",\"columnid\":\"Title\"},{\"path\":\"properties.description\",\"columnid\":\"Description\"},{\"path\":\"properties.suggestions[0].action\",\"columnid\":\"Suggestion\"},{\"path\":\"properties.creationTimeUtc\",\"columnid\":\"CreationTimeUtc\",\"columnType\":\"datetime\"},{\"path\":\"properties.lastEvaluatedTimeUtc\",\"columnid\":\"LastEvaluatedTimeUtc\",\"columnType\":\"datetime\"},{\"path\":\"properties.lastModifiedTimeUtc\",\"columnid\":\"LastModifiedTimeUtc\",\"columnType\":\"datetime\"},{\"path\":\"properties.suggestions[0].additionalProperties.DataSources\",\"columnid\":\"DataSources\"},{\"path\":\"properties.suggestions[0].additionalProperties.ConnectorIds\",\"columnid\":\"Connectors\"},{\"path\":\"properties.suggestions[0].additionalProperties.Tactics\",\"columnid\":\"Tactics\"},{\"path\":\"properties.suggestions[0].additionalProperties.ActiveDetectionsCount\",\"columnid\":\"ActiveDetectionsCount\"},{\"path\":\"properties.suggestions[0].additionalProperties.RecommendedDetectionsCount\",\"columnid\":\"RecommendedDetectionsCount\"}]}}]}",
"size": 0,
"title": "Coverage Optimization Details",
"showRefreshButton": true,
"showExportToExcel": true,
"queryType": 12,
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "State",
"formatter": 18,
"formatOptions": {
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "Active",
"representation": "turquoise",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "InProgress",
"representation": "blue",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "Dismissed",
"representation": "orange",
"text": "{0}{1}"
},
{
"operator": "contains",
"thresholdValue": "Completed",
"representation": "green",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "lightBlue",
"text": "{0}{1}"
}
],
"customColumnWidthSetting": "20ch"
}
},
{
"columnMatch": "UseCase",
"formatter": 1,
"formatOptions": {
"customColumnWidthSetting": "36ch"
}
},
{
"columnMatch": "Title",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "48ch"
}
},
{
"columnMatch": "Description",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "44ch"
}
},
{
"columnMatch": "CreationTimeUtc",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "26ch"
}
},
{
"columnMatch": "LastEvaluatedTimeUtc",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "26ch"
}
},
{
"columnMatch": "LastModifiedTimeUtc",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "26ch"
}
},
{
"columnMatch": "DataSources",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true,
"customColumnWidthSetting": "50ch"
}
},
{
"columnMatch": "Connectors",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
}
},
{
"columnMatch": "Tactics",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkIsContextBlade": true
}
},
{
"columnMatch": "ActiveDetectionsCount",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "25ch"
}
},
{
"columnMatch": "TableName",
"formatter": 0,
"formatOptions": {
"customColumnWidthSetting": "25ch"
}
},
{
"columnMatch": "CreatedTimeUtc",
"formatter": 6,
"formatOptions": {
"customColumnWidthSetting": "26ch"
}
},
{
"columnMatch": "Suggestions",
"formatter": 7,
"formatOptions": {
"linkTarget": "CellDetails",
"linkLabel": "📋",
"linkIsContextBlade": true,
"customColumnWidthSetting": "16ch"
}
}
],
"filter": true
},
"sortBy": [],
"graphSettings": {
"type": 0,
"topContent": {
"columnMatch": "state",
"formatter": 1
},
"centerContent": {
"columnMatch": "Count",
"formatter": 1,
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
}
},
"mapSettings": {
"locInfo": "LatLong",
"sizeSettings": "Count",
"sizeAggregation": "Sum",
"legendMetric": "Count",
"legendAggregation": "Sum",
"itemColorSettings": {
"type": "heatmap",
"colorAggregation": "Sum",
"nodeColorField": "Count",
"heatmapPalette": "greenRed"
}
}
},
"customWidth": "95",
"name": "query-CoverageOptimizationList"
}
]
},
"customWidth": "70",
"name": "Content"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Threat-based optimization\r\n[SOC optimization](https://learn.microsoft.com/azure/sentinel/soc-optimization/soc-optimization-access?tabs=azure-portal) provides actionable recommendations to enhance security controls and maximize the value of Microsoft security services over time. \r\n\r\nThese recommendations are tailored to your environment and designed to identify cost-reduction opportunities without compromising SOC needs or coverage. They also assist in addressing coverage gaps against specific threats and refining ingestion rates for data lacking security value, streamlining Microsoft Sentinel workspace optimization while saving SOC teams time on manual analysis and research.\r\n\r\n\r\n[Threat-based optimization](https://learn.microsoft.com/azure/sentinel/soc-optimization/soc-optimization-reference#threat-based-optimization), also known as _coverage optimization_ provide threat-based recommendations, it looks at your ingested logs and enabled analytics rules, and compares it to the logs and detections that are required to protect, detect, and respond to specific types of attacks.\r\n\r\n[Access the SOC optimization page](https://learn.microsoft.com/azure/sentinel/soc-optimization/soc-optimization-access?tabs=azure-portal#access-the-soc-optimization-page) to find out more.",
"style": "upsell"
},
"name": "text - 1"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "paragraph",
"links": [
{
"id": "82cf504f-b72f-4b56-bd81-fff901b2c6de",
"linkTarget": "OpenBlade",
"linkLabel": "Open SOC Optimization",
"style": "primary",
"bladeOpenContext": {
"bladeName": "PrecisionPage.ReactView",
"extensionName": "Microsoft_Azure_Security_Insights",
"bladeParameters": [
{
"name": "subscriptionId",
"source": "static",
"value": "{Workspace:subscriptionId}"
},
{
"name": "resourceGroup",
"source": "static",
"value": "{Workspace:resourceGroup}"
},
{
"name": "workspaceName",
"source": "static",
"value": "{Workspace:name}"
}
]
}
}
]
},
"name": "links - 1"
}
]
},
"customWidth": "30",
"name": "Text"
}
]
},
"name": "CoverageOptimization",
"styleSettings": {
"showBorder": true
}
}
]
},
"conditionalVisibility": {
"parameterName": "Tab",
"comparison": "isEqualTo",
"value": "4"
},
"name": "SOC Optimization"
}
],
"fallbackResourceIds": [],
"fromTemplateId": "sentinel-OptimizationWorkbook",
"$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}