{ "version": "Notebook/1.0", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "d868a185-b3fe-459f-9abe-ae131ba6857f", "cellValue": "dashboard", "linkTarget": "parameter", "linkLabel": "SOC Dashboard", "subTarget": "censys_soc", "style": "link" }, { "id": "31ec11bc-556f-4365-952b-882b54aa32f2", "cellValue": "dashboard", "linkTarget": "parameter", "linkLabel": "Rescan Enrichment", "subTarget": "rescan_group", "style": "link" }, { "id": "558de07b-567b-453d-a1e7-fb2c587d1ee2", "cellValue": "dashboard", "linkTarget": "parameter", "linkLabel": "Host History", "subTarget": "asset_history", "style": "link" }, { "id": "a8bc5917-1d61-4be3-aef0-456b5c4c8eb9", "cellValue": "dashboard", "linkTarget": "parameter", "linkLabel": "Ad-Hoc IOC Lookup", "subTarget": "live_investigation", "style": "link" }, { "id": "fcc4ed44-cb2b-43a4-bc68-e142ccca82ea", "cellValue": "dashboard", "linkTarget": "parameter", "linkLabel": "Alert Trigger Enrichment", "subTarget": "censys_alert_enrichment", "style": "link" }, { "id": "fcc4ed44-cb2b-43a4-bc68-e142ccca82eb", "cellValue": "dashboard", "linkTarget": "parameter", "linkLabel": "Related Infrastructure", "subTarget": "censys_related_infrastructure", "style": "link" } ] }, "name": "links - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Rescan Enrichment" }, "name": "text - 6" }, { "type": 1, "content": { "json": "This workbook depends on the **CensysRescan** logic app which is deployed with the Microsoft Sentinel Solution.
\nPlease configure this logic app first and keep it enabled in order to use this workbook.", "style": "info" }, "name": "text - 5" }, { "type": 1, "content": { "json": "## Censys Rescan Workbook\n\n**Purpose**: Rescan indicators (Hosts or Web Properties) to get fresh threat intelligence from Censys.\n\n### Setup (2 steps)\n1. **Select Environment**: Choose your Subscription ID and Resource Group\n2. **Choose Target Type**: Pick \"Host\" or \"Web Property\" from the filter\n\n### Enter Target Details\n\n**For Host Scans:**\n- IP Address (e.g., 192.168.1.100)\n- Port (e.g., 80)\n- Protocol(e.g., HTTP)\n- Transport Protocol (from dropdown)\n\n**For Web Property Scans:**\n- Domain (e.g., suspicious-site.com)\n- Port (e.g., 443)\n\n### Run Rescan\n1. Click **\"Run Playbook\"** and select **Incident** or **Alert**\n2. In the side panel, click **\"Get Rescan Data\"**\n3. CensysRescan Logic App processes your request automatically\n4. **Results Delivery**:\n - **Incident Rescan**: Comments added directly to your Incident\n - **Alert Rescan**: If alert has an associated Incident, comments added to that Incident\n - **All Results**: Data also ingested into your Log Analytics Workspace\n\n### Important Notes\n- **Comment Requirements**: No comments added if Host/Domain isn't found in the Incident\n- **Progress Tracking**: Monitor Logic App status:\n - **Incident Rescan**: Check CensysRescan Logic App\n - **Alert Rescan**: Check CensysAlertRescan Logic App\n\n", "style": "upsell" }, "name": "text - 7" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "58177fdd-636c-451e-b053-eef88ba6f6c4", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "value": { "durationMs": 86400000 } }, { "id": "43793c4d-802b-46ca-a014-944c326eeb77", "version": "KqlParameterItem/1.0", "name": "SubscriptionId", "label": "Subscription ID", "type": 2, "isRequired": true, "query": "Resources\n| distinct subscriptionId", "typeSettings": { "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null }, { "id": "661a2d42-12a6-44a9-83e9-d43ce9c6e660", "version": "KqlParameterItem/1.0", "name": "ResourceGroup", "label": "Resource Group", "type": 2, "isRequired": true, "query": "Resources\n| extend ResourceGroupName = resourceGroup\n| distinct ResourceGroupName", "typeSettings": { "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null }, { "id": "faa1789d-899b-4927-a0e6-24137bb252e4", "version": "KqlParameterItem/1.0", "name": "Workspace", "type": 5, "description": "Select Workspace where your incident resides", "isRequired": true, "isGlobal": true, "query": "where type =~ \"microsoft.operationalinsights/workspaces\"\n| where resourceGroup =~ \"{ResourceGroup}\"", "typeSettings": { "resourceTypeFilter": { "microsoft.operationalinsights/workspaces": true }, "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "3a64dda9-8114-4e7f-b8ea-20296c2d2315", "version": "KqlParameterItem/1.0", "name": "IndicatorType", "label": "Indicator Type", "type": 2, "isRequired": true, "typeSettings": { "showDefault": false }, "jsonData": "[\"Host\", \"Web Property\"]", "timeContext": { "durationMs": 86400000 }, "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parameters - 1" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "343a2afe-d9e1-4b0e-84d9-120c8b7563ad", "version": "KqlParameterItem/1.0", "name": "Port", "type": 1, "isRequired": true, "timeContext": { "durationMs": 86400000 }, "value": "" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "15", "conditionalVisibilities": [ { "parameterName": "SubscriptionId", "comparison": "isNotEqualTo" }, { "parameterName": "ResourceGroup", "comparison": "isNotEqualTo" }, { "parameterName": "IndicatorType", "comparison": "isNotEqualTo" } ], "name": "port_parameter" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "c109be16-2a66-49c9-a8b2-aa3488f4f360", "version": "KqlParameterItem/1.0", "name": "IP", "type": 1, "isRequired": true, "timeContext": { "durationMs": 86400000 } }, { "id": "2c7884d9-8412-4f36-b284-4f9dd6426018", "version": "KqlParameterItem/1.0", "name": "Protocol", "type": 1, "isRequired": true, "timeContext": { "durationMs": 86400000 } }, { "id": "013f4412-226c-413f-b256-964448b40018", "version": "KqlParameterItem/1.0", "name": "TransportProtocol", "label": "Transport Protocol", "type": 2, "isRequired": true, "typeSettings": { "showDefault": false }, "jsonData": "[\"unknown\", \"tcp\", \"udp\", \"icmp\", \"quic\"]", "timeContext": { "durationMs": 1209600000 }, "timeContextFromParameter": "TimeRange", "value": "tcp" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "SubscriptionId", "comparison": "isNotEqualTo" }, { "parameterName": "ResourceGroup", "comparison": "isNotEqualTo" }, { "parameterName": "IndicatorType", "comparison": "isEqualTo", "value": "Host" } ], "name": "host_parameters" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "26224684-f07b-4daf-b696-50ea1b8106c7", "version": "KqlParameterItem/1.0", "name": "Domain", "label": "Host Name", "type": 1, "isRequired": true, "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "30", "conditionalVisibilities": [ { "parameterName": "SubscriptionId", "comparison": "isNotEqualTo" }, { "parameterName": "ResourceGroup", "comparison": "isNotEqualTo" }, { "parameterName": "IndicatorType", "comparison": "isEqualTo", "value": "Web Property" } ], "name": "web_property_parameters" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend IncidentID = IncidentName\n| extend IncidentNumber = toint(IncidentNumber)\n| extend RunPlaybook = \"Run Playbook\"\n| where Status != \"Deleted\"\n| mv-expand AlertIds to typeof(string)\n| join kind=leftouter (\n SecurityAlert\n | project SystemAlertId, Entities\n) on $left.AlertIds == $right.SystemAlertId\n| mv-expand parsedEntities = parse_json(Entities)\n| extend EntityType = tostring(parsedEntities.Type)\n| extend EntityValue = case(\n EntityType == \"filehash\", tostring(parsedEntities.Value),\n EntityType == \"ip\", tostring(parsedEntities.Address),\n EntityType == \"dns\", tostring(parsedEntities.DomainName),\n \"\"\n)\n| where EntityType in (\"filehash\", \"ip\", \"dns\") and isnotempty(EntityValue)\n| summarize \n FileHashes = strcat_array(make_set_if(EntityValue, EntityType == \"filehash\"), \", \"),\n IPAddresses = strcat_array(make_set_if(EntityValue, EntityType == \"ip\"), \", \"),\n DNSNames = strcat_array(make_set_if(EntityValue, EntityType == \"dns\"), \", \"),\n arg_max(TimeGenerated, Title, Severity, Status, RunPlaybook, IncidentID) \n by IncidentNumber\n| project TimeGenerated, IncidentID, IncidentNumber, FileHashes, IPAddresses, DNSNames, RunPlaybook, Title, Severity, Status", "size": 1, "showAnalytics": true, "title": "Incidents", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "IncidentID", "exportParameterName": "IncidentID", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "RunPlaybook", "formatter": 7, "formatOptions": { "linkTarget": "ArmAction", "linkIsContextBlade": true, "armActionContext": { "path": "/subscriptions/{SubscriptionId}/resourceGroups/{ResourceGroup}/providers/Microsoft.Logic/workflows/CensysRescan/triggers/manual/run?api-version=2016-10-01", "body": "{\r\n \"ioc_type\": \"{IndicatorType}\",\r\n \"incident_arm_id\": \"/subscriptions/{SubscriptionId}/resourceGroups/{ResourceGroup}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:label}/providers/Microsoft.SecurityInsights/incidents/{IncidentID}\",\r\n \"incident_id\": \"{IncidentID}\",\r\n \"ip\": \"{IP}\",\r\n \"port\": \"{Port}\",\r\n \"protocol\": \"{Protocol}\",\r\n \"transport_protocol\": \"{TransportProtocol}\",\r\n \"hostname\": \"{Domain}\"\r\n}", "httpMethod": "POST", "description": "# Actions can potentially modify resources.\n## Please use caution and include a confirmation message in this description when authoring this command.", "runLabel": "Get Rescan Data" } } } ], "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "IncidentNumber", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "IncidentNumber", "sortOrder": 1 } ] }, "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Get Alerts with entities\r\nSecurityAlert\r\n| summarize arg_max(TimeGenerated, *) by SystemAlertId\r\n| extend AlertID = SystemAlertId\r\n| extend RunPlaybook = \"Run Playbook\"\r\n| where Status != \"Closed\"\r\n| mv-expand parsedEntities = todynamic(Entities)\r\n| extend EntityType = tostring(parsedEntities.Type)\r\n| extend EntityValue = case(\r\n EntityType == \"filehash\",\r\n tostring(parsedEntities.Value),\r\n EntityType == \"ip\",\r\n tostring(parsedEntities.Address),\r\n EntityType == \"dns\",\r\n tostring(parsedEntities.DomainName),\r\n \"\"\r\n )\r\n| where EntityType in (\"filehash\", \"ip\", \"dns\") and isnotempty(EntityValue)\r\n| summarize \r\n FileHashes = strcat_array(make_set_if(EntityValue, EntityType == \"filehash\"), \", \"),\r\n IPAddresses = strcat_array(make_set_if(EntityValue, EntityType == \"ip\"), \", \"),\r\n DNSNames = strcat_array(make_set_if(EntityValue, EntityType == \"dns\"), \", \"),\r\n arg_max(TimeGenerated, AlertName, AlertSeverity, Status, VendorName, RunPlaybook)\r\n by AlertID\r\n| join kind=leftouter (\r\n SecurityIncident\r\n | mv-expand AlertIds\r\n | extend AlertID = tostring(AlertIds)\r\n | summarize IncidentID = take_any(IncidentName) by AlertID\r\n) on AlertID\r\n| extend IncidentID = coalesce(IncidentID, \"N/A\")\r\n| project\r\n TimeGenerated,\r\n AlertID,\r\n AlertName,\r\n FileHashes,\r\n IPAddresses,\r\n DNSNames,\r\n RunPlaybook,\r\n IncidentID,\r\n AlertSeverity,\r\n Status,\r\n VendorName", "size": 1, "showAnalytics": true, "title": "Alerts", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "AlertID", "exportParameterName": "AlertID", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "RunPlaybook", "formatter": 7, "formatOptions": { "linkTarget": "ArmAction", "linkIsContextBlade": true, "armActionContext": { "path": "/subscriptions/{SubscriptionId}/resourceGroups/{ResourceGroup}/providers/Microsoft.Logic/workflows/CensysAlertRescan/triggers/manual/run?api-version=2016-10-01", "body": "{\r\n \"ioc_type\": \"{IndicatorType}\",\r\n \"alert_id\": \"{AlertID}\",\r\n \"ip\": \"{IP}\",\r\n \"port\": \"{Port}\",\r\n \"protocol\": \"{Protocol}\",\r\n \"transport_protocol\": \"{TransportProtocol}\",\r\n \"hostname\": \"{Domain}\"\r\n}", "httpMethod": "POST", "description": "# Actions can potentially modify resources.\n## Please use caution and include a confirmation message in this description when authoring this command.", "runLabel": "Get Rescan Data" } } } ], "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "FileHashes", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "FileHashes", "sortOrder": 1 } ] }, "name": "Alerts" } ], "exportParameters": true }, "conditionalVisibility": { "parameterName": "dashboard", "comparison": "isEqualTo", "value": "rescan_group" }, "name": "rescan_group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Ad-Hoc IOC Lookup" }, "name": "text - 3" }, { "type": 1, "content": { "json": "This workbook depends on the **CensysIOCLookup** logic app which is deployed with the Microsoft Sentinel Solution.
\nPlease configure this logic app first and keep it enabled in order to use this workbook.", "style": "info" }, "name": "text - 2" }, { "type": 1, "content": { "json": "## Ad-Hoc IOC Lookup Workbook\n\n**Purpose**: Quickly investigate indicators (Host, Web Property, Certificate) without creating incidents or alerts.\n\n### Quick Setup (3 steps)\n1. **Select Environment**: Choose Subscription ID and Resource Group\n2. **Choose Indicator Type**: Pick Host, Web Property, or Certificate\n3. **Enter Indicator Value**: Input the IOC you want to investigate\n\n**Indicator Format Examples:**\n- **Host**: `192.168.1.100` or `10.0.0.1`\n- **Web Property**: `1.1.1.1:443` or `abc.com:80` (host:port format)\n- **Certificate**: Certificate fingerprint or SHA hash\n\n### Run IOC Lookup\n1. Click **\"Submit\"**\n2. In side panel, click **\"Get Ad-Hoc Lookup Data\"**\n3. Wait for **\"Click on refresh icon to check data availability\"** message\n4. Click refresh icon until you see **\"Click here to populate data\"**\n5. Click the message to view all indicator data panels\n\n\n### Important Notes\n- **New Environments**: First-time lookups take 10-20 minutes (Microsoft Sentinel delay)\n- **Hard Refresh**: Required before each new IOC lookup for proper panel population\n- **Data Range**: Results include last 1 hour only\n- **Progress Tracking**: Monitor CensysIOCLookup Logic App run status for real-time progress updates\n\n", "style": "upsell" }, "name": "text - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "43793c4d-802b-46ca-a014-944c326eeb77", "version": "KqlParameterItem/1.0", "name": "SubscriptionId", "label": "Subscription ID", "type": 2, "isRequired": true, "query": "Resources\n| distinct subscriptionId", "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null }, { "id": "661a2d42-12a6-44a9-83e9-d43ce9c6e660", "version": "KqlParameterItem/1.0", "name": "ResourceGroup", "label": "Resource Group", "type": 2, "isRequired": true, "query": "Resources\n| extend ResourceGroupName = resourceGroup\n| distinct ResourceGroupName", "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null }, { "id": "3a64dda9-8114-4e7f-b8ea-20296c2d2315", "version": "KqlParameterItem/1.0", "name": "IndicatorType", "label": "Indicator Type", "type": 2, "isRequired": true, "typeSettings": { "showDefault": false }, "jsonData": "[\"Host\", \"Web Property\", \"Certificate\"]", "timeContext": { "durationMs": 86400000 }, "value": null }, { "id": "d9f9e6d2-8010-4064-ba77-3b68602f0881", "version": "KqlParameterItem/1.0", "name": "IndicatorValue", "label": "Indicator Value", "type": 1, "description": "Enter Indicator value", "isRequired": true, "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "paragraph", "links": [ { "id": "3a453ce0-0386-4241-baa0-2720f64b30b4", "cellValue": "", "linkTarget": "ArmAction", "linkLabel": "Submit", "postText": "", "style": "primary", "linkIsContextBlade": true, "armActionContext": { "path": "/subscriptions/{SubscriptionId}/resourceGroups/{ResourceGroup}/providers/Microsoft.Logic/workflows/CensysIOCLookup/triggers/manual/run?api-version=2016-10-01", "body": "{\n \"indicator_type\": \"{IndicatorType}\",\n \"indicator_value\": \"{IndicatorValue}\"\n}", "httpMethod": "POST", "description": "# Actions can potentially modify resources.\n## Please use caution and include a confirmation message in this description when authoring this command.", "actionName": "Playbook Trigger", "runLabel": "Get Ad-Hoc Lookup Data" } } ] }, "conditionalVisibilities": [ { "parameterName": "SubscriptionId", "comparison": "isNotEqualTo" }, { "parameterName": "ResourceGroup", "comparison": "isNotEqualTo" }, { "parameterName": "IndicatorType", "comparison": "isNotEqualTo" }, { "parameterName": "IndicatorValue", "comparison": "isNotEqualTo" } ], "name": "links - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, ip_s: string, hostname_s:string, port_d:real,fingerprint_sha256_s:string ) [];\r\nunion isfuzzy=true dummy_table, \r\n(Censys_Host_IOC_CL | where '{IndicatorType}' == \"Host\"| where ip_s == '{IndicatorValue}') , \r\n(Censys_Web_Property_IOC_CL | where '{IndicatorType}' == 'Web Property'| extend web_property = strcat(hostname_s,\":\",toint(port_d)) | where web_property == '{IndicatorValue}'),\r\n(Censys_Certificate_IOC_CL | where '{IndicatorType}' == 'Certificate'| where fingerprint_sha256_s == '{IndicatorValue}')\r\n| summarize count()\r\n| extend status = case(count_ == 0 , \"Click on refresh icon to check data availability\",\"Click here to populate data.\")\r\n| project status", "size": 3, "timeContext": { "durationMs": 3600000 }, "showRefreshButton": true, "exportFieldName": "status", "exportParameterName": "status", "exportDefaultValue": "", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "status" }, "showBorder": false, "size": "full" } }, "customWidth": "30", "conditionalVisibilities": [ { "parameterName": "SubscriptionId", "comparison": "isNotEqualTo" }, { "parameterName": "ResourceGroup", "comparison": "isNotEqualTo" }, { "parameterName": "IndicatorType", "comparison": "isNotEqualTo" }, { "parameterName": "IndicatorValue", "comparison": "isNotEqualTo" } ], "name": "query - 5", "styleSettings": { "margin": "28px" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_main_table = datatable(TimeGenerated: datetime, ip_s: string) [];\nlet mainTable = union isfuzzy=true dummy_main_table, Censys_Host_IOC_CL\n| where ip_s == '{IndicatorValue}'\n| top 1 by TimeGenerated;\nmainTable\n| summarize arg_max(TimeGenerated,*) by ip_s\n| extend\n ip = column_ifexists(\"ip_s\", \"\"),\n service_count = column_ifexists(\"service_count_d\", int(null)),\n labels = column_ifexists(\"labels_s\", \"\"),\n services = column_ifexists(\"services_s\", \"\"),\n dns_names = column_ifexists(\"dns_names_s\", \"\"),\n dns_forward = column_ifexists(\"dns_forward_dns_s\", \"\"),\n dns_reverse_names = column_ifexists(\"dns_reverse_dns_names_s\", \"\"),\n asn = column_ifexists(\"autonomous_system_asn_d\", int(null)),\n as_name = column_ifexists(\"autonomous_system_name_s\", \"\"),\n city = column_ifexists(\"location_city_s\", \"\"),\n province = column_ifexists(\"location_province_s\", \"\"),\n postal_code = column_ifexists(\"location_postal_code_s\", \"\"),\n country = column_ifexists(\"location_country_s\", \"\"),\n country_code = column_ifexists(\"location_country_code_s\", \"\"),\n continent = column_ifexists(\"location_continent_s\", \"\"),\n latitude = column_ifexists(\"location_coordinates_latitude_d\", real(null)),\n longitude = column_ifexists(\"location_coordinates_longitude_d\", real(null)),\n timezone = column_ifexists(\"location_timezone_s\", \"\"),\n whois_network_name = column_ifexists(\"whois_network_name_s\", \"\"),\n whois_network_cidrs = column_ifexists(\"whois_network_cidrs_s\", \"\")\n| extend dns_names = replace_string(replace_string(replace_string(replace_string(dns_names,']',''),'[',''),',',', '),'\"','')\n| extend dns_reverse_names = replace_string(replace_string(replace_string(replace_string(dns_reverse_names,']',''),'[',''),',',', '),'\"','')\n| extend whois_network_cidrs = replace_string(replace_string(replace_string(replace_string(whois_network_cidrs,']',''),'[',''),',',', '),'\"','')\n| project \n TimeGenerated,\n ['Host IP'] = ip,\n ['Service Count'] = service_count,\n ['ASN'] = asn,\n ['AS Name'] = as_name,\n ['DNS Names'] = dns_names,\n ['DNS Forward'] = dns_forward,\n ['DNS Reverse Names'] = dns_reverse_names,\n ['Host Labels'] = labels,\n ['City'] = city,\n ['Province'] = province,\n ['Postal Code'] = postal_code,\n ['Country'] = country,\n ['Country Code'] = country_code,\n ['Continent'] = continent,\n ['Latitude'] = latitude,\n ['Longitude'] = longitude,\n ['Timezone'] = timezone,\n ['Whois Network Name'] = whois_network_name,\n ['Whois Network CIDRs'] = whois_network_cidrs", "size": 4, "showAnalytics": true, "title": "Host Details For : {IndicatorValue}", "noDataMessage": "Refresh panel if no data is available.", "timeContext": { "durationMs": 3600000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "name": "query - 0", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_main_table = datatable(TimeGenerated: datetime, ip_s: string) [];\nlet mainTable = union isfuzzy=true dummy_main_table, Censys_Host_Services_CL\n| where ip_s == '{IndicatorValue}';\nmainTable\n| extend \n port = column_ifexists(\"port_d\", int(null)),\n protocol = column_ifexists(\"protocol_s\", \"\"),\n transport_protocol = column_ifexists(\"transport_protocol_s\", \"\"),\n scan_time = column_ifexists(\"scan_time_t\", datetime(null))\n| summarize arg_max(TimeGenerated, *) by port, protocol, transport_protocol\n| extend \n labels = column_ifexists(\"labels_s\", \"\"),\n threats = column_ifexists(\"threats_s\", \"\"),\n vulns = column_ifexists(\"vulns_s\", \"\")\n| extend \n label_values = extract_all(@'\"value\":\\s*\"([^\"]+)\"', labels)\n| extend \n labels_csv = iff(array_length(label_values) > 0, strcat_array(label_values, \", \"), \"\")\n| project \n TimeGenerated,\n ['Port'] = port,\n ['Protocol'] = protocol,\n ['Transport Protocol'] = transport_protocol,\n ['Scan Time'] = scan_time,\n ['Labels'] = labels_csv,\n ['Threats'] = threats,\n ['Vulnerabilities'] = vulns", "size": 0, "showAnalytics": true, "title": "Service Details", "noDataMessage": "Refresh panel if no data is available.", "timeContext": { "durationMs": 3600000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000 } }, "name": "query - 0 - Copy", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibilities": [ { "parameterName": "status", "comparison": "isEqualTo", "value": "Click here to populate data." }, { "parameterName": "IndicatorType", "comparison": "isEqualTo", "value": "Host" } ], "name": "host-ioc-enrichment-group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\nlet dummy_main_table = datatable(TimeGenerated: datetime, ip_s: string, hostname_s:string, port_d:real, fingerprint_sha256:string) [];\nlet dummy_endpoint_table = datatable(TimeGenerated: datetime, hostname_s:string, port_d:real, endpoint_type_s:string, path_s:string) [];\nlet mainTable = union isfuzzy=true dummy_main_table, Censys_Web_Property_IOC_CL\n| extend web_property = strcat(hostname_s, \":\", toint(port_d))\n| where web_property == '{IndicatorValue}'\n| top 1 by TimeGenerated;\nlet endpointsList = Censys_Web_Property_Endpoint_CL\n| union isfuzzy=true dummy_endpoint_table\n| extend web_property = strcat(hostname_s, \":\", toint(port_d))\n| where web_property == '{IndicatorValue}'\n| summarize \n endpoint_types=make_list(endpoint_type_s),\n paths=make_list(path_s),\n endpoint_details = make_list(strcat(toint(port_d), \" / \", endpoint_type_s, \" \", path_s))\nby web_property;\nmainTable\n| join kind=leftouter (\n endpointsList\n) on web_property\n| extend software_s = column_ifexists(\"software_s\", \"[]\"),\n scan_time = column_ifexists(\"scan_time_t\", datetime(null)),\n labels = column_ifexists(\"labels_s\", dynamic([])),\n cert_fingerprint_sha256 = column_ifexists(\"cert_fingerprint_sha256_s\", \"\"),\n cert_subject_dn = column_ifexists(\"cert_parsed_subject_dn_s\", \"\"),\n cert_issuer_dn = column_ifexists(\"cert_parsed_issuer_dn_s\", \"\"),\n cert_common_name = column_ifexists(\"cert_parsed_subject_common_name_s\", \"\"),\n cert_valid_not_before = column_ifexists(\"cert_parsed_validity_period_not_before_t\", datetime(null)),\n cert_valid_not_after = column_ifexists(\"cert_parsed_validity_period_not_after_t\", datetime(null)),\n cert_signature_self_signed = column_ifexists(\"cert_parsed_signature_self_signed_s\", \"\")\n| extend parsed_software = todynamic(software_s)\n| mv-expand software = parsed_software\n| summarize \n vendors = make_list(software.vendor),\n products = make_list(software.product),\n versions = make_list(software.version),\n software_data = make_list(software) by \n hostname_s, \n port_d, \n scan_time, \n web_property, \n labels, \n tostring(endpoint_types), \n tostring(paths), \n tostring(endpoint_details), \n cert_fingerprint_sha256, \n cert_subject_dn, \n cert_issuer_dn, \n cert_common_name, \n cert_valid_not_before, \n cert_valid_not_after,\n cert_signature_self_signed\n| extend \n vendors = strcat_array(todynamic(vendors), \", \"),\n products = strcat_array(todynamic(products), \", \"),\n versions = strcat_array(todynamic(versions), \", \"),\n endpoint_types = strcat_array(todynamic(endpoint_types), \", \"),\n paths = strcat_array(todynamic(paths), \", \"),\n endpoint_details = strcat_array(todynamic(endpoint_details), \", \"),\n labels = strcat_array(todynamic(labels), \", \"),\n cert_common_name = strcat_array(todynamic(cert_common_name), \", \")\n| project \n ['Hostname'] = hostname_s,\n ['Port'] = toint(port_d),\n ['Web Property'] = web_property,\n ['Scan Time'] = scan_time,\n ['Software Vendors'] = vendors,\n ['Software Products'] = products,\n ['Software Versions'] = versions,\n ['Endpoint Types'] = endpoint_types,\n ['Paths'] = paths,\n ['Endpoint Details'] = endpoint_details,\n ['Labels'] = labels,\n ['Certificate Fingerprint'] = cert_fingerprint_sha256,\n ['Certificate Subject DN'] = cert_subject_dn,\n ['Certificate Issuer DN'] = cert_issuer_dn,\n ['Certificate Common Name'] = cert_common_name,\n ['Certificate Valid From'] = cert_valid_not_before,\n ['Certificate Valid To'] = cert_valid_not_after,\n ['Certificate Signature Self Signed'] = cert_signature_self_signed", "size": 4, "showAnalytics": true, "title": "Web Property Details For : {IndicatorValue}", "noDataMessage": "Refresh panel if no data is available.", "timeContext": { "durationMs": 3600000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "name": "query - 0", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_main_table = datatable(TimeGenerated: datetime, hostname_s:string, port_d:real, id_s:string) [];\nlet mainTable = union isfuzzy=true dummy_main_table, Censys_Web_Property_Vuln_CL\n| extend web_property = strcat(hostname_s, \":\", toint(port_d))\n| where web_property == '{IndicatorValue}'\n| summarize arg_max(TimeGenerated, *) by hostname_s, port_d, id_s\n;\nmainTable\n| extend \n hostname_s = column_ifexists(\"hostname_s\", \"\"),\n port_d = column_ifexists(\"port_d\", real(0)),\n source_s = column_ifexists(\"source_s\", \"\"),\n metrics_cvss_v31_score_d = coalesce(column_ifexists(\"metrics_cvss_v31_score_d\", real(0)), column_ifexists(\"metrics_cvss_v30_score_d\", real(0)), column_ifexists(\"metrics_cvss_v40_score_d\", real(0))),\n id_s = column_ifexists(\"id_s\", \"\"),\n name_s = column_ifexists(\"name_s\", \"\"),\n severity_s = column_ifexists(\"severity_s\", \"\"),\n confidence_d = column_ifexists(\"confidence_d\", real(0)),\n year_d = column_ifexists(\"year_d\", int(0)),\n risk_source_s = column_ifexists(\"risk_source_s\", \"\"),\n metrics_epss_score_d = column_ifexists(\"metrics_epss_score_d\", real(0)),\n metrics_epss_percentile_d = column_ifexists(\"metrics_epss_percentile_d\", real(0)),\n // CVSS Vector - coalesce across all versions\n metrics_cvss_v31_vector_s = coalesce(column_ifexists(\"metrics_cvss_v31_vector_s\", \"\"), column_ifexists(\"metrics_cvss_v30_vector_s\", \"\"), column_ifexists(\"metrics_cvss_v40_vector_s\", \"\")),\n // CVSS Components - coalesce across all versions\n metrics_cvss_v31_attack_vector_s = coalesce(column_ifexists(\"metrics_cvss_v31_components_attack_vector_s\", \"\"), column_ifexists(\"metrics_cvss_v30_components_attack_vector_s\", \"\"), column_ifexists(\"metrics_cvss_v40_components_attack_vector_s\", \"\")),\n metrics_cvss_v31_attack_complexity_s = coalesce(column_ifexists(\"metrics_cvss_v31_components_attack_complexity_s\", \"\"), column_ifexists(\"metrics_cvss_v30_components_attack_complexity_s\", \"\"), column_ifexists(\"metrics_cvss_v40_components_attack_complexity_s\", \"\")),\n metrics_cvss_v31_privileges_required_s = coalesce(column_ifexists(\"metrics_cvss_v31_components_privileges_required_s\", \"\"), column_ifexists(\"metrics_cvss_v30_components_privileges_required_s\", \"\"), column_ifexists(\"metrics_cvss_v40_components_privileges_required_s\", \"\")),\n metrics_cvss_v31_user_interaction_s = coalesce(column_ifexists(\"metrics_cvss_v31_components_user_interaction_s\", \"\"), column_ifexists(\"metrics_cvss_v30_components_user_interaction_s\", \"\"), column_ifexists(\"metrics_cvss_v40_components_user_interaction_s\", \"\")),\n metrics_cvss_v31_scope_s = coalesce(column_ifexists(\"metrics_cvss_v31_components_scope_s\", \"\"), column_ifexists(\"metrics_cvss_v30_components_scope_s\", \"\"), column_ifexists(\"metrics_cvss_v40_components_scope_s\", \"\")),\n metrics_cvss_v31_confidentiality_s = coalesce(column_ifexists(\"metrics_cvss_v31_components_confidentiality_s\", \"\"), column_ifexists(\"metrics_cvss_v30_components_confidentiality_s\", \"\"), column_ifexists(\"metrics_cvss_v40_components_confidentiality_s\", \"\")),\n metrics_cvss_v31_integrity_s = coalesce(column_ifexists(\"metrics_cvss_v31_components_integrity_s\", \"\"), column_ifexists(\"metrics_cvss_v30_components_integrity_s\", \"\"), column_ifexists(\"metrics_cvss_v40_components_integrity_s\", \"\")),\n metrics_cvss_v31_availability_s = coalesce(column_ifexists(\"metrics_cvss_v31_components_availability_s\", \"\"), column_ifexists(\"metrics_cvss_v30_components_availability_s\", \"\"), column_ifexists(\"metrics_cvss_v40_components_availability_s\", \"\")),\n // Additional CVSS v40 specific fields\n metrics_cvss_v40_attack_requirements_s = column_ifexists(\"metrics_cvss_v40_components_attack_requirements_s\", \"\"),\n metrics_cvss_v40_automatable_s = column_ifexists(\"metrics_cvss_v40_components_automatable_s\", \"\"),\n metrics_cvss_v40_provider_urgency_s = column_ifexists(\"metrics_cvss_v40_components_provider_urgency_s\", \"\"),\n metrics_cvss_v40_recovery_s = column_ifexists(\"metrics_cvss_v40_components_recovery_s\", \"\"),\n metrics_cvss_v40_safety_s = column_ifexists(\"metrics_cvss_v40_components_safety_s\", \"\"),\n metrics_cvss_v40_value_density_s = column_ifexists(\"metrics_cvss_v40_components_value_density_s\", \"\"),\n metrics_cvss_v40_vulnerability_response_effort_s = column_ifexists(\"metrics_cvss_v40_components_vulnerability_response_effort_s\", \"\"),\n kev_s = column_ifexists(\"kev_s\", dynamic([])),\n evidence_s = column_ifexists(\"evidence_s\", dynamic([]))\n| project \n TimeGenerated,\n ['CVE ID'] = id_s,\n ['Vulnerability Name'] = name_s,\n ['Hostname'] = hostname_s,\n ['Port'] = toint(port_d),\n ['Severity'] = severity_s,\n ['Confidence'] = confidence_d,\n ['Web Property'] = web_property,\n ['Source'] = source_s,\n ['Year'] = year_d,\n ['Risk Source'] = risk_source_s,\n ['CVSS Score'] = metrics_cvss_v31_score_d,\n ['KEV'] = kev_s,\n ['Evidence'] = evidence_s,\n ['Metrics EPSS Score'] = metrics_epss_score_d,\n ['Metrics EPSS Percentile'] = metrics_epss_percentile_d,\n ['Metrics CVSS Vector'] = metrics_cvss_v31_vector_s,\n ['Metrics Attack Vector'] = metrics_cvss_v31_attack_vector_s,\n ['Metrics Attack Complexity'] = metrics_cvss_v31_attack_complexity_s,\n ['Metrics Privileges Required'] = metrics_cvss_v31_privileges_required_s,\n ['Metrics User Interaction'] = metrics_cvss_v31_user_interaction_s,\n ['Metrics Scope'] = metrics_cvss_v31_scope_s,\n ['Metrics Confidentiality Impact'] = metrics_cvss_v31_confidentiality_s,\n ['Metrics Integrity Impact'] = metrics_cvss_v31_integrity_s,\n ['Metrics Availability Impact'] = metrics_cvss_v31_availability_s,\n // CVSS v40 specific fields\n ['Metrics Attack Requirements'] = metrics_cvss_v40_attack_requirements_s,\n ['Metrics Automatable'] = metrics_cvss_v40_automatable_s,\n ['Metrics Provider Urgency'] = metrics_cvss_v40_provider_urgency_s,\n ['Metrics Recovery'] = metrics_cvss_v40_recovery_s,\n ['Metrics Safety'] = metrics_cvss_v40_safety_s,\n ['Metrics Value Density'] = metrics_cvss_v40_value_density_s,\n ['Metrics Vulnerability Response Effort'] = metrics_cvss_v40_vulnerability_response_effort_s", "size": 0, "showAnalytics": true, "title": "Vulnerability Details", "noDataMessage": "Refresh panel if no data is available.", "timeContext": { "durationMs": 3600000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 1 } ] }, "name": "query - 0 - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_main_table = datatable(TimeGenerated: datetime, hostname_s: string, port_d: real, id_s:string) [];\nlet mainTable = union isfuzzy=true dummy_main_table, Censys_Web_Property_Threat_CL\n| extend web_property = strcat(hostname_s, \":\", toint(port_d))\n| where web_property == '{IndicatorValue}'\n| summarize arg_max(TimeGenerated, *) by hostname_s, port_d, id_s;\nmainTable\n| extend \n actors = column_ifexists(\"actors_s\", \"\"),\n confidence = column_ifexists(\"confidence_d\", real(null)),\n evidence = column_ifexists(\"evidence_s\", \"\"),\n id = column_ifexists(\"id_s\", \"\"),\n malware = column_ifexists(\"malware_s\", \"\"),\n name = column_ifexists(\"name_s\", \"\"),\n source = column_ifexists(\"source_s\", \"\"),\n tactic = column_ifexists(\"tactic_s\", \"\"),\n type = column_ifexists(\"type_s\", \"\"),\n hostname = column_ifexists(\"hostname_s\", \"\"),\n port = column_ifexists(\"port_d\", int(null)),\n details_campaign_id = column_ifexists(\"details_campaign_id_s\", \"\"),\n details_campaign_theme = column_ifexists(\"details_campaign_theme_s\", \"\"),\n details_control_servers = column_ifexists(\"details_control_servers_s\", \"\"),\n details_version = column_ifexists(\"details_version_s\", \"\"),\n malware_all_names = column_ifexists(\"malware_all_names_s\", \"\"),\n malware_id = column_ifexists(\"malware_id_s\", \"\"),\n malware_last_updated_at = column_ifexists(\"malware_last_updated_at_t\", datetime(null)),\n malware_malpedia_id = column_ifexists(\"malware_malpedia_id_s\", \"\"),\n malware_primary_name = column_ifexists(\"malware_primary_name_s\", \"\")\n| extend type = replace_string(replace_string(replace_string(replace_string(type,',',\", \"),'\"',\"\"),\"]\",\"\"),\"[\",\"\")\n| extend tactic = replace_string(replace_string(replace_string(replace_string(tactic,',',\", \"),'\"',\"\"),\"]\",\"\"),\"[\",\"\")\n| project \n TimeGenerated,\n ['Hostname'] = hostname,\n ['Port'] = port,\n ['Threat ID'] = id,\n ['Threat Name'] = name,\n ['Threat Type'] = type,\n ['Source'] = source,\n ['Confidence'] = confidence,\n ['Tactic'] = tactic,\n ['Actors'] = actors,\n ['Malware'] = malware,\n ['Evidence'] = evidence,\n ['Details - Campaign ID'] = details_campaign_id,\n ['Details - Campaign Theme'] = details_campaign_theme,\n ['Details - Control Servers'] = details_control_servers,\n ['Details - Version'] = details_version,\n ['Malware - All Names'] = malware_all_names,\n ['Malware - ID'] = malware_id,\n ['Malware - Last Updated'] = malware_last_updated_at,\n ['Malware - Malpedia ID'] = malware_malpedia_id,\n ['Malware - Primary Name'] = malware_primary_name", "size": 0, "showAnalytics": true, "title": "Threat Details", "noDataMessage": "Refresh panel if no data is available.", "timeContext": { "durationMs": 3600000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 1 } ] }, "name": "query - 0 - Copy - Copy", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibilities": [ { "parameterName": "status", "comparison": "isEqualTo", "value": "Click here to populate data." }, { "parameterName": "IndicatorType", "comparison": "isEqualTo", "value": "Web Property" } ], "name": "web-property-ioc-enrichment-group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_main_table = datatable(TimeGenerated: datetime, fingerprint_sha256_s: string) [];\nlet mainTable = union isfuzzy=true dummy_main_table, Censys_Certificate_IOC_CL\n| where fingerprint_sha256_s == '{IndicatorValue}'\n| top 1 by TimeGenerated;\nmainTable\n| extend\n fingerprint_sha256_ext = column_ifexists(\"fingerprint_sha256_s\", \"\"),\n valid_to = column_ifexists(\"valid_to_t\", datetime(null)),\n self_signed = column_ifexists(\"self_signed_b\", \"\"),\n subject_dn = column_ifexists(\"parsed_subject_dn_s\", \"\"),\n issuer_dn = column_ifexists(\"parsed_issuer_dn_s\", \"\"),\n subject_common_name = column_ifexists(\"parsed_subject_common_name_s\", \"\"),\n validity_not_before = column_ifexists(\"parsed_validity_period_not_before_t\", datetime(null)),\n validity_not_after = column_ifexists(\"parsed_validity_period_not_after_t\", datetime(null)),\n signature_self_signed = column_ifexists(\"parsed_signature_self_signed_b\", \"\")\n| extend subject_common_name = replace_string(replace_string(replace_string(replace_string(subject_common_name,',',\", \"),'\"',\"\"),\"]\",\"\"),\"[\",\"\")\n| project \n ['Fingerprint SHA256'] = fingerprint_sha256_ext,\n ['Subject DN'] = subject_dn,\n ['Issuer DN'] = issuer_dn,\n ['Subject Common Name'] = subject_common_name,\n ['Valid Not Before'] = validity_not_before,\n ['Valid Not After'] = validity_not_after,\n ['Self Signed (Signature)'] = signature_self_signed,\n ['Valid To'] = valid_to,\n ['Self Signed'] = self_signed", "size": 4, "showAnalytics": true, "title": "Certificate Details For : {IndicatorValue}", "noDataMessage": "Refresh panel if no data is available.", "timeContext": { "durationMs": 3600000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "name": "query - 0", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibilities": [ { "parameterName": "status", "comparison": "isEqualTo", "value": "Click here to populate data." }, { "parameterName": "IndicatorType", "comparison": "isEqualTo", "value": "Certificate" } ], "name": "certificate-ioc-enrichment-group" } ] }, "name": "group - 2" } ] }, "conditionalVisibility": { "parameterName": "dashboard", "comparison": "isEqualTo", "value": "live_investigation" }, "name": "group - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "e3932418-89bd-4bf7-8b6a-d3026a73e1eb", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| where ModifiedBy contains \"playbook - censys\" \n| count ", "size": 3, "title": "# of Incident Enriched", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 0, "palette": "blue" } }, "showBorder": false } }, "customWidth": "0", "name": "query - 0", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| where ModifiedBy contains \"playbook - censys\" \n| project TimeGenerated, IncidentName, IncidentNumber, IncidentUrl, Title, Severity, Status, ProviderIncidentId, ProviderName, CreatedTime, LastModifiedTime, FirstActivityTime, AlertIds, Comments, AdditionalData, ModifiedBy, Type", "size": 0, "showAnalytics": true, "title": "Incidents Enriched", "noDataMessage": "No data found.", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "IncidentName", "exportParameterName": "IncidentName", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url" } } ], "rowLimit": 10000, "filter": true } }, "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "👆🏻 Click on above 'Incidents Enriched' grid to see enriched data.", "style": "info" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummyData = datatable(TimeGenerated:datetime, incident_arm_id_s:string, type_s:string, ip_s:string)[];\n union isfuzzy=true dummyData, Incident_Enrich_Data_CL\n| where type_s == \"host\" and isnotempty(ip_s)\n| where incident_arm_id_s contains '{IncidentName}'\n| summarize arg_max(TimeGenerated, *) by type_s, ip_s\n| extend \n autonomous_system_name_s = column_ifexists(\"autonomous_system_name_s\", \"\"),\n autonomous_system_asn_s = column_ifexists(\"autonomous_system_asn_s\", \"\"),\n whois_network_name_s = column_ifexists(\"whois_network_name_s\", \"\"),\n whois_network_cidrs_s = column_ifexists(\"whois_network_cidrs_s\", \"\"),\n location_city_s = column_ifexists(\"location_city_s\", \"\"),\n location_postal_code_s = column_ifexists(\"location_postal_code_s\", \"\"),\n location_province_s = column_ifexists(\"location_province_s\", \"\"),\n location_country_s = column_ifexists(\"location_country_s\", \"\"),\n location_country_code_s = column_ifexists(\"location_country_code_s\", \"\"),\n location_continent_s = column_ifexists(\"location_continent_s\", \"\"),\n location_coordinates_latitude_d = column_ifexists(\"location_coordinates_latitude_d\", real(null)),\n location_coordinates_longitude_d = column_ifexists(\"location_coordinates_longitude_d\", real(null)),\n dns_names_s = column_ifexists(\"dns_names_s\", \"\"),\n reverse_dns_names_s = column_ifexists(\"reverse_dns_names_s\", \"\"),\n forward_dns_names_s = column_ifexists(\"forward_dns_names_s\", \"\"),\n service_count_d = column_ifexists(\"service_count_d\", int(null)),\n labels_s = column_ifexists(\"labels_s\", \"\"),\n services_s = column_ifexists(\"services_s\", \"\"),\n playbook_s = column_ifexists(\"playbook_s\", \"\")\n| extend whois_network_cidrs_s = replace_string(replace_string(replace_string(replace_string(whois_network_cidrs_s,']',''),'[',''),',',', '),'\\\"','')\n| extend dns_names_s = replace_string(replace_string(replace_string(replace_string(dns_names_s,']',''),'[',''),',',', '),'\\\"','')\n| extend reverse_dns_names_s = replace_string(replace_string(replace_string(replace_string(reverse_dns_names_s,']',''),'[',''),',',', '),'\\\"','')\n| extend forward_dns_names_s = replace_string(replace_string(replace_string(replace_string(forward_dns_names_s,']',''),'[',''),',',', '),'\\\"','')\n| project \n TimeGenerated,\n ['Type'] = type_s,\n ['IP Address'] = ip_s,\n ['Autonomous System Name'] = autonomous_system_name_s,\n ['Autonomous System ASN'] = autonomous_system_asn_s,\n ['Whois Network Name'] = whois_network_name_s,\n ['Whois Network CIDRs'] = whois_network_cidrs_s,\n ['Services'] = services_s,\n ['Location City'] = location_city_s,\n ['Location Postal Code'] = location_postal_code_s,\n ['Location Province'] = location_province_s,\n ['Location Country'] = location_country_s,\n ['Location Country Code'] = location_country_code_s,\n ['Location Continent'] = location_continent_s,\n ['Location Latitude'] = location_coordinates_latitude_d,\n ['Location Longitude'] = location_coordinates_longitude_d,\n ['DNS Names'] = dns_names_s,\n ['Reverse DNS Names'] = reverse_dns_names_s,\n ['Forward DNS Names'] = forward_dns_names_s,\n ['Service Count'] = service_count_d,\n ['Labels'] = labels_s,\n ['Incident ARM ID'] = incident_arm_id_s,\n ['Playbook'] = playbook_s", "size": 0, "showAnalytics": true, "title": "Host Enrichment Details For Incident : {IncidentName}", "noDataMessage": "No data found.", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url" } } ], "filter": true } }, "conditionalVisibility": { "parameterName": "IncidentName", "comparison": "isNotEqualTo" }, "name": "query - 2 - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummyData = datatable(TimeGenerated:datetime, incident_arm_id_s:string, type_s:string, hostname_s:string, port_d:real)[];\nunion isfuzzy=true dummyData, Incident_Enrich_Data_CL\n| where type_s == \"web property\" and isnotempty(hostname_s)\n| where incident_arm_id_s contains '{IncidentName}'\n| summarize arg_max(TimeGenerated, *) by type_s, hostname_s, port_d\n| extend \n endpoints_s = column_ifexists(\"endpoints_s\", \"\"),\n labels_s = column_ifexists(\"labels_s\", \"\"),\n threats_s = column_ifexists(\"threats_s\", \"\"),\n vulns_s = column_ifexists(\"vulns_s\", \"\"),\n scan_time_t = column_ifexists(\"scan_time_t\", datetime(null)),\n software_s = column_ifexists(\"software_s\", \"\"),\n fingerprint_sha256_s = column_ifexists(\"fingerprint_sha256_s\", \"\"),\n subject_common_name_s = column_ifexists(\"subject_common_name_s\", \"\"),\n subject_dn_s = column_ifexists(\"subject_dn_s\", \"\"),\n issuer_dn_s = column_ifexists(\"issuer_dn_s\", \"\"),\n validity_period_not_after_t = column_ifexists(\"validity_period_not_after_t\", datetime(null)),\n validity_period_not_before_t = column_ifexists(\"validity_period_not_before_t\", datetime(null)),\n signature_self_signed_t = column_ifexists(\"signature_self_signed_t\", \"\"),\n playbook_s = column_ifexists(\"playbook_s\", \"\")\n| extend threats_s = replace_string(replace_string(replace_string(replace_string(threats_s,']',''),'[',''),',',', '),'\\\"','')\n| extend subject_common_name_s = replace_string(replace_string(replace_string(replace_string(subject_common_name_s,']',''),'[',''),',',', '),'\\\"','')\n| extend \n software_clean = replace_string(replace_string(replace_string(software_s, '},{', '|'), '},{', '|'), '\"', ''),\n vendors = extract_all(@'\"Vendor\":\"([^\"]+)\"', software_s),\n products = extract_all(@'\"Product\":\"([^\"]+)\"', software_s),\n versions = extract_all(@'\"Version\":\"([^\"]+)\"', software_s)\n| extend \n VendorsCSV = iff(isempty(vendors), \"\", strcat_array(vendors, \", \")),\n ProductsCSV = iff(isempty(products), \"\", strcat_array(products, \", \")),\n VersionsCSV = iff(isempty(versions), \"\", strcat_array(versions, \", \"))\n| extend EndpointsTypePath = replace_string(replace_string(replace_string(replace_string(replace_string(replace_string(replace_string(replace_string(endpoints_s,'{\"Endpoint Type\":\"',''),'\",\"Path\":\"',' '),'\"}',''),'},{',', '),'[',''),']',''),'\"',''), \",\",\", \")\n| project \n TimeGenerated,\n ['Type'] = type_s,\n ['Hostname'] = hostname_s,\n ['Port'] = port_d,\n ['Endpoints Type/Path']=EndpointsTypePath,\n ['Labels'] = labels_s,\n ['Threats'] = threats_s,\n ['Vulnerabilities'] = vulns_s,\n ['Scan Time'] = scan_time_t,\n ['Software Vendors'] = VendorsCSV,\n ['Software Products'] = ProductsCSV,\n ['Software Versions'] = VersionsCSV,\n ['Fingerprint SHA256'] = fingerprint_sha256_s,\n ['Subject Common Name'] = subject_common_name_s,\n ['Subject DN'] = subject_dn_s,\n ['Issuer DN'] = issuer_dn_s,\n ['Incident ARM ID'] = incident_arm_id_s,\n ['Validity Period Not After'] = validity_period_not_after_t,\n ['Validity Period Not Before'] = validity_period_not_before_t,\n ['Signature Self Signed'] = signature_self_signed_t,\n ['Playbook'] = playbook_s", "size": 0, "showAnalytics": true, "title": "Web Property Enrichment Details For Incident : {IncidentName}", "noDataMessage": "No data found.", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url" } } ], "filter": true } }, "conditionalVisibility": { "parameterName": "IncidentName", "comparison": "isNotEqualTo" }, "name": "query - 2 - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummyData = datatable(TimeGenerated:datetime, incident_arm_id_s:string, type_s:string, fingerprint_sha256_s:string)[];\nunion isfuzzy=true dummyData, Incident_Enrich_Data_CL\n| where type_s == \"certificate\" and isnotempty(fingerprint_sha256_s)\n| where incident_arm_id_s contains '{IncidentName}'\n| summarize arg_max(TimeGenerated, *) by type_s, fingerprint_sha256_s\n| extend \n parsed_subject_dn_s = column_ifexists(\"parsed_subject_dn_s\", \"\"),\n parsed_issuer_dn_s = column_ifexists(\"parsed_issuer_dn_s\", \"\"),\n parsed_subject_common_name_s = column_ifexists(\"parsed_subject_common_name_s\", \"\"),\n parsed_validity_period_not_before_t = column_ifexists(\"parsed_validity_period_not_before_t\", datetime(null)),\n parsed_validity_period_not_after_t = column_ifexists(\"parsed_validity_period_not_after_t\", datetime(null)),\n parsed_signature_self_signed_s = column_ifexists(\"parsed_signature_self_signed_s\", \"\"),\n valid_to_t = column_ifexists(\"valid_to_t\", datetime(null)),\n self_signed_s = column_ifexists(\"self_signed_s\", \"\"),\n playbook_s = column_ifexists(\"playbook_s\", \"\")\n| extend parsed_subject_common_name_s = replace_string(replace_string(replace_string(replace_string(parsed_subject_common_name_s,']',''),'[',''),',',', '),'\\\"','')\n| project \n TimeGenerated,\n ['Type'] = type_s,\n ['Fingerprint SHA256'] = fingerprint_sha256_s,\n ['Subject DN'] = parsed_subject_dn_s,\n ['Issuer DN'] = parsed_issuer_dn_s,\n ['Subject Common Name'] = parsed_subject_common_name_s,\n ['Validity Period Not Before'] = parsed_validity_period_not_before_t,\n ['Validity Period Not After'] = parsed_validity_period_not_after_t,\n ['Signature Self Signed'] = parsed_signature_self_signed_s,\n ['Incident ARM ID'] = incident_arm_id_s,\n ['Valid To'] = valid_to_t,\n ['Self Signed'] = self_signed_s,\n ['Playbook'] = playbook_s", "size": 0, "showAnalytics": true, "title": "Certificate Enrichment Details For Incident : {IncidentName}", "noDataMessage": "No data found.", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url" } } ], "filter": true } }, "conditionalVisibility": { "parameterName": "IncidentName", "comparison": "isNotEqualTo" }, "name": "query - 2 - Copy - Copy - Copy", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "dashboard", "comparison": "isEqualTo", "value": "censys_soc" }, "name": "group - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Host History" }, "name": "text - 0" }, { "type": 1, "content": { "json": "This workbook depends on the **CensysHostHistory** logic app which is deployed with the Microsoft Sentinel Solution.
\nPlease configure this logic app first and keep it enabled in order to use this workbook.", "style": "info" }, "name": "text - 1" }, { "type": 1, "content": { "json": "## Censys Host History Workbook\n\n**Purpose**: Pull historical data for a specific host to investigate past activity and changes over time.\n\n### Setup (2 steps)\n1. **Select Environment**: Choose your Subscription ID and Resource Group\n2. **Enter Time Range & Target**:\n - **Start Time**: When to begin data collection (e.g., 2026-01-01T00:00:00Z)\n - **End Time**: When to stop data collection (e.g., 2026-01-02T00:00:00Z)\n - **Host**: Target IP address\n\n**Time Format Tips:**\n- Use format: YYYY-MM-DDT00:00:00Z\n- Example: Jan 1, 2026 → 2026-01-01T00:00:00Z\n- For full day data: Set end time to next day's start\n\n### Run History Pull\n1. Click **\"Submit\"** (activates when all fields are filled)\n2. In side panel, click **\"Get Host History Data\"**\n3. CensysHostHistory Logic App processes your request\n4. Data appears in your Log Analytics Workspace\n\n### What You Get\n- Complete host activity history for your time range up to 1000 events.\n\n### Important Notes\n- **Processing Time**: Larger time ranges require more processing time\n- **Data Destination**: Results are sent to Log Analytics Workspace\n- **Progress Tracking**: Monitor CensysHostHistory Logic App run status for real-time progress updates\n- **Record Limits**: If more than 1,000 records exist, only the first 1,000 are displayed in the workbook. Use Censys platform for complete dataset exploration\n\n", "style": "upsell" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "43793c4d-802b-46ca-a014-944c326eeb77", "version": "KqlParameterItem/1.0", "name": "SubscriptionId", "label": "Subscription ID", "type": 2, "isRequired": true, "query": "Resources\n| distinct subscriptionId", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null }, { "id": "661a2d42-12a6-44a9-83e9-d43ce9c6e660", "version": "KqlParameterItem/1.0", "name": "ResourceGroup", "label": "Resource Group", "type": 2, "isRequired": true, "query": "Resources\n| extend ResourceGroupName = resourceGroup\n| distinct ResourceGroupName", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null }, { "id": "e61a3f63-e4de-4c36-83f4-de9270494867", "version": "KqlParameterItem/1.0", "name": "start_time", "label": "Start Time", "type": 1, "description": "Start Time For Host History data to lookup for", "isRequired": true, "timeContext": { "durationMs": 86400000 } }, { "id": "9ab5b736-7cf3-4df8-96fe-f320a86b20bb", "version": "KqlParameterItem/1.0", "name": "end_time", "label": "End Time", "type": 1, "description": "End Time For Host History data to lookup for", "isRequired": true, "timeContext": { "durationMs": 86400000 } }, { "id": "3f184823-0373-4bfd-ad7a-2b33a53ad2fe", "version": "KqlParameterItem/1.0", "name": "host", "label": "Host", "type": 1, "description": "IP Address for host which history should be fetch", "isRequired": true, "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parameters - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "paragraph", "links": [ { "id": "31d6eb07-0e8f-4ea0-abc3-8d43171f2f27", "linkTarget": "ArmAction", "linkLabel": "Submit", "style": "primary", "linkIsContextBlade": true, "armActionContext": { "path": "/subscriptions/{SubscriptionId}/resourceGroups/{ResourceGroup}/providers/Microsoft.Logic/workflows/CensysHostHistory/triggers/manual/run?api-version=2016-10-01", "body": "{\n \"start_time\": \"{start_time}\",\n \"end_time\": \"{end_time}\",\n \"host\": \"{host}\"\n}", "httpMethod": "POST", "description": "# Actions can potentially modify resources.\n## Please use caution and include a confirmation message in this description when authoring this command.", "runLabel": "Get Host History Data" } } ] }, "conditionalVisibilities": [ { "parameterName": "start_time", "comparison": "isNotEqualTo" }, { "parameterName": "end_time", "comparison": "isNotEqualTo" }, { "parameterName": "host", "comparison": "isNotEqualTo" }, { "parameterName": "SubscriptionId", "comparison": "isNotEqualTo" }, { "parameterName": "ResourceGroup", "comparison": "isNotEqualTo" } ], "name": "links - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, ip_s: string, event_time_t:datetime) [];\nunion isfuzzy=true dummy_table, \n(Censys_Host_History_Data_CL | where ip_s == \"{host}\" and start_time_t == datetime(\"{start_time}\") and end_time_t == datetime(\"{end_time}\"))\n| summarize count()\n| extend status = case(count_ == 0 , \"Click on refresh icon to check data availability\",\"Click here to populate data.\")\n| project status", "size": 3, "timeContext": { "durationMs": 3600000 }, "showRefreshButton": true, "exportFieldName": "status", "exportParameterName": "status", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "status" }, "showBorder": false, "size": "full" } }, "customWidth": "30", "conditionalVisibilities": [ { "parameterName": "SubscriptionId", "comparison": "isNotEqualTo" }, { "parameterName": "ResourceGroup", "comparison": "isNotEqualTo" }, { "parameterName": "start_time", "comparison": "isNotEqualTo" }, { "parameterName": "end_time", "comparison": "isNotEqualTo" }, { "parameterName": "host", "comparison": "isNotEqualTo" } ], "name": "query - 6", "styleSettings": { "margin": "28px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Censys_Host_History_Data_CL\n| where ip_s == \"{host}\" and start_time_t == datetime(\"{start_time}\") and end_time_t == datetime(\"{end_time}\")\n| project [\"Event Time\"]=event_time_s, [\"Event History\"]=ui_link_s, [\"Resource Type\"]=resource_type_s, [\"Resource Details\"]=display_data_s", "size": 0, "showAnalytics": true, "title": "Host History", "noDataMessage": "No data found", "timeContext": { "durationMs": 3600000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Event History", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "View Host History on Censys Platform" } } ], "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "status", "comparison": "isEqualTo", "value": "Click here to populate data." }, "name": "Host History" } ] }, "conditionalVisibility": { "parameterName": "dashboard", "comparison": "isEqualTo", "value": "asset_history" }, "name": "group - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "c665b2c4-eddb-4422-8411-18a821d3fbcf", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 86400000 }, "label": "Time Range" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, alert_id_g: string, ip_s:string, incident_arm_id_s: string, dns_names_s: string, reverse_dns_names_s: string, services_s: string, service_count_d: real, location_city_s: string, location_country_s: string, location_province_s: string, location_postal_code_s: string, location_continent_s: string, location_coordinates_latitude_d: real, location_coordinates_longitude_d: real, whois_network_cidrs_s: string, whois_network_name_s: string, autonomous_system_asn_s: string, autonomous_system_name_s: string, type_s: string) [];\nunion isfuzzy=true dummy_table,\nIncident_Enrich_Data_CL\n| where isnotempty(alert_id_g)\n| where type_s == \"host\"\n| join kind=leftouter (SecurityAlert\n| project SystemAlertId, Entities, TimeGenerated\n| mv-expand parsedEntities = todynamic(Entities)\n| extend EntityType = todynamic(parsedEntities.Type)\n| extend EntityValue = case(\n EntityType == \"filehash\",\n tostring(parsedEntities.Value),\n EntityType == \"ip\",\n tostring(parsedEntities.Address),\n EntityType == \"dns\",\n tostring(parsedEntities.DomainName),\n \"\"\n )\n| where EntityType in (\"filehash\", \"ip\", \"dns\") and isnotempty(EntityValue)\n| summarize \n FileHashes = strcat_array(make_set_if(EntityValue, EntityType == \"filehash\"), \", \"),\n IPAddresses = strcat_array(make_set_if(EntityValue, EntityType == \"ip\"), \", \"),\n DNSNames = strcat_array(make_set_if(EntityValue, EntityType == \"dns\"), \", \"),\n arg_max(TimeGenerated, *)\n by SystemAlertId\n) on $left.alert_id_g == $right.SystemAlertId\n| where isnotempty(SystemAlertId)\n| summarize arg_max(TimeGenerated, *) by SystemAlertId, ip_s\n| project TimeGenerated, SystemAlertId, IP=ip_s, [\"Incident ARM ID\"]=incident_arm_id_s, [\"DNS Names\"]=dns_names_s, [\"Reverse DNS Names\"]=reverse_dns_names_s, Services=services_s, [\"Service Count\"]=service_count_d, City=location_city_s, Country=location_country_s, Province=location_province_s, [\"Postal Code\"]=location_postal_code_s, Continent=location_continent_s, Latitude=location_coordinates_latitude_d, Longitude=location_coordinates_longitude_d, CIDRs=whois_network_cidrs_s, [\"Network Name\"]=whois_network_name_s, ASN=autonomous_system_asn_s, Name=autonomous_system_name_s", "size": 0, "showAnalytics": true, "title": "Alert Enrichment for Host Entities", "noDataMessage": "No data found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, alert_id_g: string, hostname_s: string, port_d: real, incident_arm_id_s: string, software_s: string, threats_s: string, vulns_s: string, endpoints_s: string, fingerprint_sha256_s: string, subject_dn_s: string, issuer_dn_s: string, subject_common_name_s: string, validity_period_not_before_t: datetime, validity_period_not_after_t: datetime, scan_time_t: datetime, type_s: string) [];\nunion isfuzzy=true dummy_table,\nIncident_Enrich_Data_CL\n| where isnotempty(alert_id_g)\n| where type_s == \"web property\"\n| join kind=leftouter (SecurityAlert\n| project SystemAlertId, Entities, TimeGenerated\n| mv-expand parsedEntities = todynamic(Entities)\n| extend EntityType = tostring(parsedEntities.Type)\n| extend EntityValue = case(\n EntityType == \"filehash\",\n tostring(parsedEntities.Value),\n EntityType == \"ip\",\n tostring(parsedEntities.Address),\n EntityType == \"dns\",\n tostring(parsedEntities.DomainName),\n \"\"\n )\n| where EntityType in (\"filehash\", \"ip\", \"dns\") and isnotempty(EntityValue)\n| summarize \n FileHashes = strcat_array(make_set_if(EntityValue, EntityType == \"filehash\"), \", \"),\n IPAddresses = strcat_array(make_set_if(EntityValue, EntityType == \"ip\"), \", \"),\n DNSNames = strcat_array(make_set_if(EntityValue, EntityType == \"dns\"), \", \"),\n arg_max(TimeGenerated, *)\n by SystemAlertId\n) on $left.alert_id_g == $right.SystemAlertId\n| where isnotempty(SystemAlertId)\n| summarize arg_max(TimeGenerated, *) by SystemAlertId, hostname_s, port_d\n| project TimeGenerated, SystemAlertId, Host=hostname_s, Port=port_d, [\"Incident ARM ID\"]=incident_arm_id_s, Software=software_s, Threat=threats_s, Vulnerabilities=vulns_s, Endpoint=endpoints_s, SHA256=fingerprint_sha256_s, [\"Subject DN\"]=subject_dn_s, [\"Issuer DN\"]=issuer_dn_s, [\"Subject Common name\"]=subject_common_name_s, [\"Not Before Period\"]=validity_period_not_before_t, [\"Not After period\"]=validity_period_not_after_t, [\"Scan Time\"]=scan_time_t", "size": 0, "showAnalytics": true, "title": "Alert Enrichment for WebProperty Entities", "noDataMessage": "No data found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 1 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, alert_id_g: string, incident_arm_id_s: string, fingerprint_sha256_s: string, parsed_subject_dn_s: string, parsed_issuer_dn_s: string, parsed_subject_common_name_s: string, parsed_validity_period_not_before_t: datetime, parsed_validity_period_not_after_t: datetime, parsed_signature_self_signed_b: bool, type_s: string) [];\nunion isfuzzy=true dummy_table,\nIncident_Enrich_Data_CL\n| where isnotempty(alert_id_g)\n| where type_s == \"certificate\"\n| join kind=leftouter (SecurityAlert\n| project SystemAlertId, Entities, TimeGenerated\n| mv-expand parsedEntities = todynamic(Entities)\n| extend EntityType = tostring(parsedEntities.Type)\n| extend EntityValue = case(\n EntityType == \"filehash\",\n tostring(parsedEntities.Value),\n EntityType == \"ip\",\n tostring(parsedEntities.Address),\n EntityType == \"dns\",\n tostring(parsedEntities.DomainName),\n \"\"\n )\n| where EntityType in (\"filehash\", \"ip\", \"dns\") and isnotempty(EntityValue)\n| summarize \n FileHashes = strcat_array(make_set_if(EntityValue, EntityType == \"filehash\"), \", \"),\n IPAddresses = strcat_array(make_set_if(EntityValue, EntityType == \"ip\"), \", \"),\n DNSNames = strcat_array(make_set_if(EntityValue, EntityType == \"dns\"), \", \"),\n arg_max(TimeGenerated, *)\n by SystemAlertId\n) on $left.alert_id_g == $right.SystemAlertId\n| where isnotempty(SystemAlertId)\n| summarize arg_max(TimeGenerated, *) by SystemAlertId, fingerprint_sha256_s\n| project TimeGenerated, SystemAlertId, SHA256=fingerprint_sha256_s, [\"Incident ARM ID\"]=incident_arm_id_s, [\"Subject DN\"]=parsed_subject_dn_s, [\"Issuer DN\"]=parsed_issuer_dn_s, [\"Subject Common name\"]=parsed_subject_common_name_s, [\"Not Before Period\"]=parsed_validity_period_not_before_t, [\"Not After period\"]=parsed_validity_period_not_after_t, [\"Self Signed\"]=parsed_signature_self_signed_b", "size": 0, "showAnalytics": true, "title": "Alert Enrichment for Certificate Entities", "noDataMessage": "No data found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 1 - Copy - Copy" } ] }, "conditionalVisibility": { "parameterName": "dashboard", "comparison": "isEqualTo", "value": "censys_alert_enrichment" }, "name": "group - 6" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Related Infrastructure" }, "name": "text - 3" }, { "type": 1, "content": { "json": "This workbook depends on the **CensysRelatedInfrastructure** logic app which is deployed with the Microsoft Sentinel Solution.
\nPlease configure this logic app first and keep it enabled in order to use this workbook.", "style": "info" }, "name": "text - 2" }, { "type": 1, "content": { "json": "## Related Infrastructure Workbook\n\n**Purpose**: Use the CensEye-powered pivot to find assets that share key-value characteristics with the IOC you care about. The workbook submits the indicator to the **CensysRelatedInfrastructure** logic app so you can pull the resulting hosts, web properties, or certificates, pivot into those related assets, and build queries or collections without creating incidents or alerts. [Learn more about CensEye in the Censys documentation.](https://docs.censys.com/docs/platform-threat-hunting-use-censeye-to-build-detections)\n\n\n### Quick Setup (3 steps)\n1. **Select Environment**: Choose Subscription ID and Resource Group\n2. **Choose Indicator Type**: Pick Host, Web Property, or Certificate\n3. **Enter Indicator Value**: Input the IOC you want to investigate\n\n**Indicator Format Examples:**\n- **Host**: `192.168.1.100` or `10.0.0.1`\n- **Web Property**: `1.1.1.1:443` or `abc.com:80` (host:port format)\n- **Certificate**: SHA-256 fingerprint of the certificate to analyze. e.g. `3daf2843a77b6f4e6af43cd9b6f6746053b8c928e056e8a724808db8905a94cf`\n\n### Run Related Infrastructure\n1. Click **\"Submit\"**\n2. In side panel, click **\"Get Related Infrastructure Data\"**\n3. Wait for **\"Click on refresh icon to check data availability\"** message\n4. Click refresh icon until you see **\"Click here to populate data\"**\n5. Click the message to view all indicator data.\n\n\n### Important Notes\n- **New Environments**: First-time lookups take 10-20 minutes (Microsoft Sentinel delay)\n- **Hard Refresh**: Required before each new IOC Related Infrastructure Details for proper panel population\n- **Data Range**: Results include last 1 hour only\n- **Progress Tracking**: Monitor CensysRelatedInfrastructure Logic App run status for real-time progress updates\n\n", "style": "upsell" }, "name": "text - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "43793c4d-802b-46ca-a014-944c326eeb77", "version": "KqlParameterItem/1.0", "name": "SubscriptionId", "label": "Subscription ID", "type": 2, "isRequired": true, "query": "Resources\n| distinct subscriptionId", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null }, { "id": "661a2d42-12a6-44a9-83e9-d43ce9c6e660", "version": "KqlParameterItem/1.0", "name": "ResourceGroup", "label": "Resource Group", "type": 2, "isRequired": true, "query": "Resources\n| extend ResourceGroupName = resourceGroup\n| distinct ResourceGroupName", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null }, { "id": "3a64dda9-8114-4e7f-b8ea-20296c2d2315", "version": "KqlParameterItem/1.0", "name": "IndicatorType", "label": "Indicator Type", "type": 2, "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\"Host\", \"Web Property\", \"Certificate\"]", "timeContext": { "durationMs": 86400000 }, "value": null }, { "id": "d9f9e6d2-8010-4064-ba77-3b68602f0881", "version": "KqlParameterItem/1.0", "name": "IndicatorValue", "label": "Indicator Value", "type": 1, "description": "Enter Indicator value", "isRequired": true, "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "paragraph", "links": [ { "id": "3a453ce0-0386-4241-baa0-2720f64b30b4", "cellValue": "", "linkTarget": "ArmAction", "linkLabel": "Submit", "postText": "", "style": "primary", "linkIsContextBlade": true, "armActionContext": { "path": "/subscriptions/{SubscriptionId}/resourceGroups/{ResourceGroup}/providers/Microsoft.Logic/workflows/CensysRelatedInfrastructure/triggers/manual/run?api-version=2016-10-01", "headers": [], "params": [], "body": "{\n \"ioc_type\": \"{IndicatorType}\",\n \"ioc_value\": \"{IndicatorValue}\"\n}", "httpMethod": "POST", "description": "# Actions can potentially modify resources.\n## Please use caution and include a confirmation message in this description when authoring this command.", "actionName": "Playbook Trigger", "runLabel": "Get Related Infrastructure Data" } } ] }, "conditionalVisibilities": [ { "parameterName": "SubscriptionId", "comparison": "isNotEqualTo" }, { "parameterName": "ResourceGroup", "comparison": "isNotEqualTo" }, { "parameterName": "IndicatorType", "comparison": "isNotEqualTo" }, { "parameterName": "IndicatorValue", "comparison": "isNotEqualTo" } ], "name": "links - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, ip_s: string, event_time_t:datetime) [];\r\nunion isfuzzy=true dummy_table, \r\n(CensysRelatedInfrastructure_CL | where ioc_s == \"{IndicatorValue}\" )\r\n| summarize count()\r\n| extend status = case(count_ == 0 , \"Click on refresh icon to check data availability\",\"Click here to populate data.\")\r\n| project status", "size": 3, "timeContext": { "durationMs": 3600000 }, "showRefreshButton": true, "exportFieldName": "status", "exportParameterName": "status", "exportDefaultValue": "", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "status" }, "showBorder": false, "size": "full" } }, "customWidth": "30", "conditionalVisibilities": [ { "parameterName": "SubscriptionId", "comparison": "isNotEqualTo" }, { "parameterName": "ResourceGroup", "comparison": "isNotEqualTo" }, { "parameterName": "IndicatorType", "comparison": "isNotEqualTo" }, { "parameterName": "IndicatorValue", "comparison": "isNotEqualTo" } ], "name": "query - 5", "styleSettings": { "margin": "28px" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CensysRelatedInfrastructure_CL\n| where ioc_s == \"{IndicatorValue}\"\n| project Count = count_d, Fields = fields_s, Values = coalesce(values_s, values_g), [\"See results in Censys\"]=censys_url_s\n| order by Count asc, Fields asc\n", "size": 0, "showAnalytics": true, "title": "Related Infrastructure Details For : {IndicatorValue}", "noDataMessage": "Refresh panel if no data is available.", "timeContext": { "durationMs": 3600000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "See results in Censys", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "View on Censys" } } ], "rowLimit": 10000, "filter": true } }, "name": "query - 0", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "status", "comparison": "isEqualTo", "value": "Click here to populate data." }, "name": "related-infrastructure-group" } ] }, "name": "group - 2" } ] }, "conditionalVisibility": { "parameterName": "dashboard", "comparison": "isEqualTo", "value": "censys_related_infrastructure" }, "name": "group - 5" } ], "fromTemplateId": "sentinel-Censys", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }