{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## AWS network activities\n\nThis workbook summarizes AWS CloudTrail network-related activity across regions, security group and network ACL changes, create/delete network events, and Elastic IP operations. Use the time range and event filters to investigate spikes, correlate activity, and drill into details."
      },
      "name": "text - 0"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "query": "",
        "crossComponentResources": [],
        "parameters": [
          {
            "id": "b9e68383-3369-42fc-b7e7-506fd187832d",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 1209600000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 1"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let data = AWSCloudTrail;\r\ndata\r\n| summarize Count = count() by AWSRegion\r\n| join kind = fullouter (datatable(AWSRegion:string)['OneDrive', 'SharePoint']) on AWSRegion\r\n| project AWSRegion = iff(AWSRegion == '', AWSRegion1, AWSRegion), Count = iff(AWSRegion == '', 0, Count)\r\n| join kind = inner (data\r\n    | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AWSRegion)\r\n    on AWSRegion\r\n| project-away AWSRegion1, TimeGenerated\r\n| extend AWSRegion = AWSRegion\r\n| union (\r\n    data \r\n    | summarize Count = count() \r\n    | extend jkey = 1\r\n    | join kind=inner (data\r\n        | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n        | extend jkey = 1) on jkey\r\n    | extend AWSRegion = 'All', AWSRegions = '*'    \r\n)\r\n| order by Count desc\r\n| take 10\r\n",
        "size": 4,
        "exportFieldName": "AWSRegion",
        "exportParameterName": "AWSRegion",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "Top 10 active regions - click to filter",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "AWSRegion",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "min": 0,
              "palette": "blue",
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": "info",
        "showExportToExcel": true
      },
      "name": "Top AWS Regions by Network Activity"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AWSCloudTrail\r\n//| where EventSource == \"ec2.amazonaws.com\" and (EventName startswith \"create\" or EventName startswith \"replace\" or EventName startswith \"delete\" or EventName startswith \"authorize\" or EventName startswith \"revoke\") and (EventName !contains \"Volume\" and EventName !contains \"KeyPair\" and EventName !contains \"Tags\" and EventName !contains \"Image\" and EventName !contains \"LaunchTemplate\")\r\n| where AWSRegion == '{AWSRegion}' or '{AWSRegion}' == \"All\"\r\n| summarize count() by AWSRegion, bin(TimeGenerated, {TimeRange:grain})",
        "size": 0,
        "exportToExcelOptions": "visible",
        "title": "Network events, by region",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": "info",
        "exportParameterName": "SelectedRow_0",
        "showExportToExcel": true
      },
      "customWidth": "50",
      "name": "Network events by region"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AWSCloudTrail\r\n//| where EventSource == \"ec2.amazonaws.com\" and (EventName startswith \"create\" or EventName startswith \"replace\" or EventName startswith \"delete\" or EventName startswith \"authorize\" or EventName startswith \"revoke\") and (EventName !contains \"Volume\" and EventName !contains \"KeyPair\" and EventName !contains \"Tags\" and EventName !contains \"Image\" and EventName !contains \"LaunchTemplate\")\r\n| where AWSRegion == '{AWSRegion}' or '{AWSRegion}' == \"All\"\r\n| summarize count() by EventName, bin(TimeGenerated, {TimeRange:grain})",
        "size": 0,
        "exportToExcelOptions": "visible",
        "title": "Network event types",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "areachart",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": "info",
        "exportParameterName": "SelectedRow_1",
        "showExportToExcel": true
      },
      "customWidth": "50",
      "name": "Network Events by Region"
    },
    {
      "type": 1,
      "content": {
        "json": "---\n### Security group and network ACL change events\n\nReview changes to security groups and network ACLs to identify configuration drift or suspicious network exposure. Use the chart to focus on specific event names before drilling into source IPs and identities."
      },
      "name": "text - 6"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AWSCloudTrail\r\n| where EventSource == \"ec2.amazonaws.com\" and (EventName == \"AuthorizeSecurityGroupEgress\" or EventName == \"AuthorizeSecurityGroupIngress\" or EventName == \"CreateSecurityGroup\" or EventName == \"RevokeSecurityGroupEgress\" or EventName == \"RevokeSecurityGroupIngress\" or EventName == \"DeleteSecurityGroup\" or EventName == \"ReplaceNetworkAclEntry\" or EventName == \"CreateNetworkAcl\" or EventName == \"DeleteNetworkAcl\")\r\n| summarize Count = count() by EventName, UserIdentityArn, AWSRegion, EventTypeName, SessionIssuerType, EventSource, SourceIpAddress\r\n| project-rename TotalChanges = Count\r\n| order by TotalChanges desc\r\n",
        "size": 0,
        "exportFieldName": "EventName",
        "exportParameterName": "EventName",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "Click to filter by event name",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "EventName",
              "formatter": 7,
              "formatOptions": {
                "linkTarget": "GenericDetails",
                "linkIsContextBlade": true,
                "showIcon": true
              }
            },
            {
              "columnMatch": "UserIdentityArn",
              "formatter": 0,
              "formatOptions": {
                "showIcon": true,
                "aggregation": "Unique"
              }
            },
            {
              "columnMatch": "AWSRegion",
              "formatter": 5,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "EventTypeName",
              "formatter": 5,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "SessionIssuerType",
              "formatter": 5,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "EventSource",
              "formatter": 5,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "SourceIpAddress",
              "formatter": 5,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "TotalChanges",
              "formatter": 4,
              "formatOptions": {
                "min": 0,
                "palette": "purple",
                "showIcon": true
              }
            }
          ],
          "filter": true,
          "labelSettings": [],
          "showExportToExcel": true
        },
        "noDataMessage": "No security group or network ACL change events found for the selected filters.",
        "noDataMessageStyle": "info",
        "showExportToExcel": true,
        "visualization": "table"
      },
      "customWidth": "50",
      "name": "Security group and network ACL changes by event"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AWSCloudTrail\r\n| where EventSource == \"ec2.amazonaws.com\" and (EventName == \"AuthorizeSecurityGroupEgress\" or EventName == \"AuthorizeSecurityGroupIngress\" or EventName == \"CreateSecurityGroup\" or EventName == \"RevokeSecurityGroupEgress\" or EventName == \"RevokeSecurityGroupIngress\" or EventName == \"DeleteSecurityGroup\" or EventName == \"ReplaceNetworkAclEntry\" or EventName == \"CreateNetworkAcl\" or EventName == \"DeleteNetworkAcl\")\r\n| where EventName == '{EventName}' or '{EventName}' == \"All\"\r\n| summarize count() by bin(TimeGenerated, {TimeRange:grain}), EventName\r\n| project-rename TotalChanges = count_\r\n",
        "size": 0,
        "exportToExcelOptions": "visible",
        "title": "Network ACL events over time",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "noDataMessage": "No network ACL events found for the selected filters.",
        "noDataMessageStyle": "info",
        "exportParameterName": "SelectedRow_2",
        "showExportToExcel": true
      },
      "customWidth": "50",
      "name": "Network ACL events over time"
    },
    {
      "type": 1,
      "content": {
        "json": "---\n### Create and Delete network events\n\nUse this section to track create/delete activity that can indicate network provisioning, teardown, or potential abuse. The time series helps spot bursts of activity and filter by specific event names."
      },
      "name": "text - 8"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AWSCloudTrail\r\n| where EventSource == \"ec2.amazonaws.com\" and (EventName startswith \"create\" or EventName startswith \"delete\") and (EventName !contains \"Volume\" and EventName !contains \"KeyPair\" and EventName !contains \"Tags\" and EventName !contains \"Image\" and EventName !contains \"LaunchTemplate\")\r\n| summarize count() by EventName, UserIdentityArn, AWSRegion, EventTypeName, SessionIssuerType, EventSource, SourceIpAddress\r\n| project-rename TotalChanges = count_ \r\n| order by TotalChanges desc\r\n\r\n",
        "size": 0,
        "exportFieldName": "EventName",
        "exportParameterName": "EventName",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "Click to filter by event name",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "EventName",
              "formatter": 7,
              "formatOptions": {
                "linkTarget": "GenericDetails",
                "linkIsContextBlade": true,
                "showIcon": true
              }
            },
            {
              "columnMatch": "UserIdentityArn",
              "formatter": 0,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "AWSRegion",
              "formatter": 5,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "EventTypeName",
              "formatter": 5,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "SessionIssuerType",
              "formatter": 5,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "EventSource",
              "formatter": 5,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "SourceIpAddress",
              "formatter": 5,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "TotalChanges",
              "formatter": 4,
              "formatOptions": {
                "min": 0,
                "palette": "blueDark",
                "showIcon": true
              }
            }
          ],
          "labelSettings": [],
          "showExportToExcel": true
        },
        "noDataMessage": "No create or delete network events found for the selected filters.",
        "noDataMessageStyle": "info",
        "showExportToExcel": true,
        "visualization": "table"
      },
      "customWidth": "50",
      "name": "Create/Delete Network Events by Event"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AWSCloudTrail\r\n| where EventSource == \"ec2.amazonaws.com\" and (EventName startswith \"create\" or EventName startswith \"delete\") and (EventName !contains \"Volume\" and EventName !contains \"KeyPair\" and EventName !contains \"Tags\" and EventName !contains \"Image\" and EventName !contains \"LaunchTemplate\")\r\n| where EventName == '{EventName}' or '{EventName}' == \"All\"\r\n| summarize count() by bin(TimeGenerated, {TimeRange:grain}), EventName\r\n| project-rename TotalChanges = count_\r\n",
        "size": 0,
        "exportToExcelOptions": "visible",
        "title": "Create and Delete network events over time",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "noDataMessage": "No Elastic IP address operations found for the selected filters.",
        "noDataMessageStyle": "info",
        "exportParameterName": "SelectedRow_0",
        "showExportToExcel": true
      },
      "customWidth": "50",
      "name": "Create and Delete network events over time"
    },
    {
      "type": 1,
      "content": {
        "json": "---\n### Elastic IP Address Operations\n\nInspect Elastic IP allocation and association activity for unexpected address changes or ownership shifts. The detail view is intended for triage and correlation with other AWS CloudTrail events."
      },
      "name": "text - 11"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AWSCloudTrail\r\n| where EventSource == \"ec2.amazonaws.com\" and (EventName == \"AllocateAddress\" or EventName == \"ReleaseAddress\" or EventName == \"AssociateAddress\" or EventName == \"DisassociateAddress\")    \r\n| extend AllocationID1 = todynamic(ResponseElements).[\"allocationId\"]\r\n| extend AllocationID2 = todynamic(RequestParameters).[\"allocationId\"]\r\n| extend AssociationID = todynamic(ResponseElements).[\"associationId\"]\r\n| extend ElasticIP = todynamic(ResponseElements).[\"publicIp\"]\r\n| extend AllocationID = coalesce(AllocationID1, AllocationID2)\r\n| summarize count() by TimeGenerated, UserIdentityArn, EventName, tostring(todynamic(RequestParameters).[\"instanceId\"]), tostring(AllocationID), tostring(AssociationID), tostring(ElasticIP) \r\n| project-rename InstanceID = RequestParameters_instanceId\r\n| project-away count_\r\n",
        "size": 0,
        "exportToExcelOptions": "visible",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "filter": true,
          "labelSettings": [],
          "showExportToExcel": true
        },
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": "info",
        "showExportToExcel": true,
        "title": "Query: AWSCloudTrail\r...",
        "exportParameterName": "SelectedRow_1"
      },
      "name": "Elastic IP Operations Details"
    }
  ],
  "styleSettings": {},
  "fromTemplateId": "sentinel-AWSNetworkActivities",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}