{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "version": "KqlParameterItem/1.0", "name": "DefaultSubscription_Internal", "type": 1, "isRequired": true, "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| take 1\r\n| project subscriptionId", "crossComponentResources": [ "value::selected" ], "isHiddenWhenLocked": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "id": "314d02bf-4691-43fa-af59-d67073c8b8fa" }, { "id": "e6ded9a1-a83c-4762-938d-5bf8ff3d3d38", "version": "KqlParameterItem/1.0", "name": "Subscription", "type": 6, "isRequired": true, "query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)", "typeSettings": { "showDefault": false }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null }, { "id": "e3225ed0-6210-40a1-b2d0-66e42ffa71d6", "version": "KqlParameterItem/1.0", "name": "Workspace", "type": 5, "isRequired": true, "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| order by name asc\r\n| summarize Selected = makelist(id, 10), All = makelist(id, 1000)\r\n| mvexpand All limit 100\r\n| project value = tostring(All), label = tostring(All), selected = iff(Selected contains All, true, false)", "crossComponentResources": [ "{Subscription}" ], "typeSettings": { "showDefault": false }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "15b2c181-7397-43c1-900a-28e175ae8a6f", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2592000000 } ], "allowCustom": true }, "value": { "durationMs": 2592000000 } } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "Parameter Selectors" }, { "type": 1, "content": { "json": "  Please take time to answer a quick survey,\r\n[ click here. ](https://forms.office.com/Pages/ResponsePage.aspx?id=v4j5cvGGr0GRqy180BHbR5vpbw39GIlPr6oh7FnjxTFUOVhBOFowTFlaT1pOSTAxVDdRT1pIUDlINy4u)" }, "name": "Survey" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [SOX IT Compliance Workbook](https://www.sec.gov/spotlight/sarbanes-oxley.htm)\n---\n\nWelcome to the **SOX IT Compliance Workbook for Microsoft Sentinel**. \nThis workbook helps you **track, visualize, and monitor SOX IT General Controls (ITGC)** across your organization to ensure compliance with the Sarbanes-Oxley Act. \nIt consolidates data from **Microsoft Defender XDR, Azure Activity Logs, Azure Policy, Microsoft 365, Entra ID, and Change Management systems.**\n\nUse this workbook to:\n- Monitor **user access control violations, privileged access changes, and login anomalies** \n- Track **configuration and code deployment changes** for audit readiness \n- Validate **data integrity, login, and retention** aligned with SOX ITGC requirements \n- Detect **unauthorized access attempts, brute-force logins, or policy deviations** \n- Provide **audit evidence, risk assessment, and compliance reporting** across cloud and enterprise systems" }, "name": "text - 2" } ] }, "customWidth": "78", "name": "group - 5" }, { "type": 1, "content": { "json": "![Image Name](https://azure.microsoft.com/svghandler/azure-sentinel?width=600&height=315) " }, "customWidth": "21", "name": "Microsoft Sentinel Logo" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "ac6f7462-59ff-4d82-86b0-0a6eccc35a51", "version": "KqlParameterItem/1.0", "name": "UserPrincipalName", "label": "🔀 User Selector", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SigninLogs\r\n| summarize by UserPrincipalName ", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "User Selector Parameter - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t{ \\\"Control Area\\\": \\\"Getting Started\\\", \\\"tab\\\": \\\"GettingStarted\\\" },\\r\\n\\t{ \\\"Control Area\\\": \\\"Access Management\\\", \\\"tab\\\": \\\"AccessManagement\\\" },\\r\\n\\t{ \\\"Control Area\\\": \\\"Change Management\\\", \\\"tab\\\": \\\"ChangeManagement\\\" },\\r\\n\\t{ \\\"Control Area\\\": \\\"Data Integrity\\\", \\\"tab\\\": \\\"DataIntegrity\\\" }\\r\\n]\",\"transformers\":null}", "size": 3, "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "tab", "parameterName": "selectedTab" } ], "queryType": 8, "gridSettings": { "formatters": [ { "columnMatch": "tab", "formatter": 5 } ] } }, "customWidth": "40", "name": "SOX IT Compliance Controls", "styleSettings": { "showBorder": true } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "version": "KqlParameterItem/1.0", "name": "isGettingStartedVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "selectedTab", "operator": "contains", "rightValType": "static", "rightVal": "GettingStarted", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "false" } } ], "id": "00647d12-5c3e-44de-a925-52b2d8c51aaf" }, { "version": "KqlParameterItem/1.0", "name": "isAccessManagementVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "selectedTab", "operator": "contains", "rightValType": "static", "rightVal": "AccessManagement", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "false" } } ], "id": "de936c29-ea39-43e1-8360-2f1cc2c722b9" }, { "version": "KqlParameterItem/1.0", "name": "isChangeManagementVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "selectedTab", "operator": "contains", "rightValType": "static", "rightVal": "ChangeManagement", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "false" } } ], "id": "ccccda63-7d20-4d80-89d4-e5dbc9e1f3d3" }, { "version": "KqlParameterItem/1.0", "name": "isDataIntegrityVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "selectedTab", "operator": "contains", "rightValType": "static", "rightVal": "DataIntegrity", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "false" } } ], "id": "2c93e511-80d6-4100-8c36-4c48be482235" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "10", "name": "SOX Visibility Parameters" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## SOX IT Compliance Overview\r\n\r\nThis workbook provides a unified view of **SOX IT Compliance** monitoring in Microsoft Sentinel.\r\n\r\n| Section | Description |\r\n|---------|-------------|\r\n| Getting Started | Overview of the SOX IT compliance framework, objectives, and monitoring areas. |\r\n| Access Management | Review and monitor user access, role assignments, privileged operations, and login anomalies. |\r\n| Change Management | Track and validate system, configuration, and application changes to ensure controlled deployments. |\r\n| Data Integrity | Monitor and verify accuracy, completeness, and consistency of financial data within monitored systems. |" }, "customWidth": "40", "name": "text - overview" }, { "type": 1, "content": { "json": "## Required Data Sources\r\n\r\nEnable the following data connectors for complete visibility:\r\n\r\n- **Microsoft Entra ID** — Sign-ins and Audit Logs\r\n- **Microsoft Defender for Identity** — Privileged escalations and lateral movement detection\r\n- **Azure Activity** — Resource and configuration changes\r\n- **Microsoft 365** — Administrative and operational actions\r\n- **SecurityEvent / BehaviorAnalytics** — System events and user behavior anomalies\r\n- **Azure SQL Databases** — Audit and diagnostic logs\r\n\r\n [Configure Data Connectors in Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/connect-data-sources)" }, "customWidth": "40", "name": "text - datasources" }, { "type": 1, "content": { "json": "---\r\n### Getting Started\r\n\r\nThe **Getting Started** section introduces SOX IT Compliance in Microsoft Sentinel. It defines the framework for monitoring controls supporting **financial reporting integrity**.\r\n\r\nKey objectives:\r\n- Establish governance for access, change, and data control.\r\n- Implement continuous monitoring of critical systems.\r\n- Generate auditable evidence for compliance reporting.\r\n\r\n [Learn More About SOX IT Controls](https://www.sec.gov/spotlight/sarbanes-oxley.htm)" }, "customWidth": "40", "name": "text - gettingstarted" }, { "type": 1, "content": { "json": "---\r\n### Access Management\r\n\r\nEnsure that only authorized users access critical financial systems.\r\n\r\nFocus Areas:\r\n- Monitor **login activities and failed sign-ins**.\r\n- Track **role and privilege modifications**.\r\n- Detect **anomalous or high-risk access** using UEBA insights.\r\n- Investigate **administrative operations** on sensitive systems.\r\n\r\n [Setup Entra ID Connector](https://learn.microsoft.com/azure/sentinel/connect-azure-active-directory)" }, "customWidth": "40", "name": "text - access" }, { "type": 1, "content": { "json": "---\r\n### Change Management\r\n\r\nTrack all configuration and system changes to ensure compliance with SOX requirements.\r\n\r\nCapabilities:\r\n- Correlate **Azure Activity** and **SecurityEvent** logs for system modifications.\r\n- Identify **unauthorized deployments or edits**.\r\n- Detect **sensitive configuration changes** in real time.\r\n- Provide **change traceability** for audit evidence.\r\n\r\n [Setup Azure Activity Connector](https://learn.microsoft.com/azure/sentinel/connect-azure-activity)" }, "customWidth": "40", "name": "text - change" }, { "type": 1, "content": { "json": "---\r\n### Data Integrity\r\n\r\nValidate that data used for financial reporting is accurate, complete, and consistent.\r\n\r\nCapabilities:\r\n- Analyze **SQL Audit Logs** for unauthorized data changes.\r\n- Detect **data manipulation or loss events**.\r\n- Monitor **data reconciliation activities**.\r\n- Maintain **evidence of data validation** for SOX reporting.\r\n\r\n [Setup Azure SQL Connector](https://learn.microsoft.com/azure/azure-sql/database/auditing-overview)" }, "customWidth": "40", "name": "text - data" }, { "type": 1, "content": { "json": "---\n### SOX Compliance Watchlist\n\nTo support **SOX** compliance, create a watchlist named **`SOX_Watchlist`** in Microsoft Sentinel.\nThis watchlist should include **identity information and financial system data** so SOX monitoring can map user actions to sensitive financial applications.\n\n#### **Watchlist Schema**\n| Column Name | Type | Description |\n|--------------|------|-------------|\n| `UserPrincipalName` | string | Email or UPN of the authorized user |\n| `DisplayName` | string | Full name of the authorized individual |\n| `Department` | string | Department or business unit (e.g., Finance) |\n| `Role` | string | Access role (e.g., FinanceAdmin, Auditor, Analyst) |\n| `AccessLevel` | string | Access level in Azure/AD (Read / Write / Admin) |\n| `FinancialSystem` | string | Financial system associated with the user |\n| `FinancialSystemAccessType` | string | Access type for the financial system (Read, Write, Approve, Admin) |\n| `FinancialDataType` | string | Type of financial data handled (GL, AP, AR, Payroll, Billing, Revenue, Procurement, Audit Logs, etc.) |\n\n#### **Storage Location**\n`/Sentinel/Watchlists/SOX_Watchlist.csv`\n\n[Learn how to create a watchlist in Microsoft Sentinel](https://learn.microsoft.com/rest/api/securityinsights/watchlists/create-or-update)`" }, "customWidth": "40", "name": "text - watchlist-info" } ] }, "conditionalVisibility": { "parameterName": "isGettingStartedVisible", "comparison": "isEqualTo", "value": "true" }, "name": "SOX Overview Group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Access Management\nOnly authorized individuals can access systems and data related to financial reporting.\n\nThis visualization cross-checks sign-in activity from financial applications against the authorized user list stored in **SOX_Watchlist**." }, "name": "Access Management Description" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SoxFinanceSystems = _GetWatchlist(\"SOX_Watchlist\") | project FinancialSystem;\n\nSigninLogs\n| where AppDisplayName in (SoxFinanceSystems) \n| extend IsFinanceApp = AppDisplayName has_any (\"SAP\", \"Oracle\", \"ERP\", \"Finance\", \"FinancePortal\")\n| where IsFinanceApp == true\n| where ResultType == 0 // Authorized only\n| summarize AuthorizedLogins = count() \n by bin(TimeGenerated, 1d), AppDisplayName\n| order by TimeGenerated asc", "size": 3, "title": "Authorized Financial System Access Only", "timeContext": { "durationMs": 604800000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "gridSettings": { "formatters": [ { "columnMatch": "AccessedByAuthorizedUser", "formatter": 7, "formatterOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Authorized", "representation": "✅" }, { "operator": "==", "thresholdValue": "Unauthorized", "representation": "❌" } ] } } ] }, "tileSettings": { "showBorder": false }, "chartSettings": { "seriesLabel": "AccessStatus", "xColumn": "TimeGenerated", "yColumn": "Logins", "legendVisible": true } }, "name": "Authorized Financial System Access Only" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\nlet SOX_Watchlist = _GetWatchlist(\"SOX_Watchlist\") | project UserPrincipalName;\n\nAuditLogs\n| where OperationName has_any (\"Add user\", \"Create user\", \"Add member to role\", \"Add directory role member\", \"Update user\", \"Role assignment\")\n| extend Initiator = tostring(InitiatedBy.user.userPrincipalName)\n| extend TargetUser = tostring(TargetResources[0].userPrincipalName)\n| where Initiator !in (SOX_Watchlist)\n| extend AuthorizationStatus = \"Watchlist_Not_Enabled\"\n| summarize EventCount = count() by OperationName, AuthorizationStatus\n| order by EventCount desc\n| render barchart", "size": 3, "title": "Daily Account / Privilege Changes", "timeContext": { "durationMs": 604800000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "tileSettings": { "showBorder": true, "titleContent": { "columnMatch": "OperationName", "formatter": 1, "text": "Daily Account / Privilege Changes" } }, "chartSettings": { "title": "Daily Account / Privilege Changes", "xAxis": "OperationName", "yAxis": "EventCount", "legend": "AuthorizationStatus" } }, "name": "Daily_Account_Privilege_Changes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SoxUsers = _GetWatchlist(\"SOX_Watchlist\") | project UserPrincipalName;\n\nAuditLogs\n| where OperationName has_any (\n \"Add user\", \n \"Create user\",\n \"Update user\",\n \"Add member to role\",\n \"Add directory role member\",\n \"Role assignment\"\n )\n| extend TargetUser = tostring(TargetResources[0].userPrincipalName)\n| where TimeGenerated >= ago(7d)\n| where TargetUser in (SoxUsers | distinct UserPrincipalName)\n| summarize DailyChanges = count() by bin(TimeGenerated, 1d)\n| render timechart\n", "size": 0, "title": "Number of New Accounts or Privilege Changes in Financial Systems", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "tileSettings": { "showBorder": false } }, "name": "Number of New Accounts or Privilege Changes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SOX_Watchlist = _GetWatchlist('SOX_Watchlist') | project UserPrincipalName, IsAuthorized, DeactivationDate, ApplicationName;\n\nSigninLogs\n| where AppDisplayName in (SOX_Watchlist | distinct ApplicationName)\n| join kind=inner (SOX_Watchlist) on $left.UserPrincipalName == $right.UserPrincipalName\n| where IsAuthorized == false or (DeactivationDate < now())\n| summarize UnauthorizedLogins = count() by bin(TimeGenerated, 1d)\n| render timechart\n", "size": 0, "title": "Logins by Users Who Shouldn’t Have Access", "timeContext": { "durationMs": 604800000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "tileSettings": { "showBorder": false }, "graphSettings": { "type": 0 }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "UnauthorizedLogins", "sizeAggregation": "Sum", "legendMetric": "UnauthorizedLogins", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "UnauthorizedLogins", "heatmapPalette": "greenRed" } } }, "name": "query - logins-unauthorized" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SOX_Watchlist = _GetWatchlist(\"SOX_Watchlist\")| project UserPrincipalName;\n\n\nAzureActivity\n| extend Actor = Caller\n| where Actor in (SOX_Watchlist) \n| where TimeGenerated >= ago(7d)\n| summarize Changes = count() by bin(TimeGenerated, 1d)\n| order by TimeGenerated asc\n| render timechart", "size": 0, "title": "Azure Activity – Privilege & Configuration Changes", "timeContext": { "durationMs": 604800000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "unstackedbar", "tileSettings": { "showBorder": false }, "graphSettings": { "type": 0 } }, "customWidth": "100", "name": "azure-activity-privilege-changes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SOX_Watchlist = _GetWatchlist(\"SOX_Watchlist\")| project UserPrincipalName;\n\n\nIdentityDirectoryEvents\n| where ActionType in (\"DirectoryRoleMembershipChanged\",\"GroupMembershipChanged\",\"SensitiveAccountChanged\",\"UserAccountControlChanged\",\"PrivilegeEscalation\")\n| extend TargetUser = tostring(TargetAccountUpn)\n| where TargetUser in (SOX_Watchlist) \n| where Timestamp >= ago(7d)\n| summarize Events = count() by bin(Timestamp, 1d), ActionType\n| order by Timestamp asc\n| render timechart\n", "size": 2, "title": "Privileged Escalations & Sensitive Access Changes (MDI)", "timeContext": { "durationMs": 604800000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "showBorder": false }, "graphSettings": { "type": 0 } }, "customWidth": "40", "name": "query-mdi-privileged-escalations" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// =============================\n// SOX Watchlist (Optional)\n// Uncomment only if SOX_Watchlist exists\n// let SOX_Watchlist = _GetWatchlist(\"SOX_Watchlist\")\n// | project UserPrincipalName;\n// =============================\n\nOfficeActivity\n| where TimeGenerated >= ago(30d)\n| where Operation in (\"MemberAdded\", \"MemberRemoved\", \"GroupAdded\", \"AddedToGroup\", \"MemberRoleChanged\")\n| extend Actor = tostring(UserId), Target = tostring(OfficeObjectId)\n| extend IsPrivilegedChange = iif(Operation in (\"MemberRoleChanged\"), \"Yes\", \"No\")\n| where Actor !in (SOX_Watchlist | project UserPrincipalName)\n| summarize Count = count() by Operation, bin(TimeGenerated, 1d)\n| order by TimeGenerated asc\n| render timechart", "size": 2, "title": "Office 365 Privileged Changes - Last 30 Days", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "tileSettings": { "showBorder": false }, "graphSettings": { "type": 0 } }, "customWidth": "60", "name": "query-officeactivity-privileged-changes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\nOfficeActivity\n| where TimeGenerated >= ago(30d)\n| where Operation in (\"Set-ConditionalAccessPolicy\", \"Remove-ConditionalAccessPolicy\")\n| extend Actor = tostring(UserId)\n| extend PolicyId = tostring(OfficeObjectId)\n| project TimeGenerated, Operation, Actor, PolicyId, ClientIP, ResultStatus\n| summarize Changes = count() by Operation, bin(TimeGenerated, 1d)\n| order by TimeGenerated asc\n| render timechart", "size": 2, "title": "Conditional Access Policy Changes", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "tileSettings": { "showBorder": true, "subtitle": "Monitors creation, deletion, or updates to CA policies" }, "graphSettings": { "type": 0 } }, "name": "query-ca-policy-changes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\nOfficeActivity\n| where TimeGenerated >= ago(30d)\n| where Operation in (\"SharingSet\", \"PermissionLevelAdded\", \"ModifyFolderPermissions\", \"AddFolderPermissions\")\n| extend Actor = tostring(UserId), Object = tostring(OfficeObjectId)\n| summarize Count = count() by Operation, bin(TimeGenerated, 1d)\n| order by TimeGenerated asc\n| render timechart", "size": 2, "title": "Sharing & Permission Changes", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "showBorder": true, "subtitle": "Monitors unauthorized sharing or permission escalation" }, "graphSettings": { "type": 0 } }, "customWidth": "40", "name": "query-sharing-permission-changes" } ] }, "conditionalVisibility": { "parameterName": "isAccessManagementVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Access Management Group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Change Management (Configuration & Change Controls)\nEnsure that all configuration or system changes to financial systems are authorized, documented, and tracked.\n\nThis section provides visibility into configuration changes, admin actions, and correlation of those changes with approved change tickets to meet SOX IT General Control requirements." }, "name": "Change Management Description" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SOX_Watchlist = _GetWatchlist(\"SOX_Watchlist\") | project UserPrincipalName;\n\nSecurityEvent\n| where EventID in (4670, 4688, 4739, 4719, 4907)\n| where Account !in (SOX_Watchlist)\n| summarize Changes = count() by Account\n| top 10 by Changes\n| render barchart", "size": 3, "title": "Configuration Changes & Admin Actions in Financial Systems", "timeContext": { "durationMs": 604800000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "tileSettings": { "showBorder": true }, "graphSettings": { "type": 0 } }, "name": "query-financial-config-changes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SOX_Watchlist = _GetWatchlist(\"SOX_Watchlist\") | project UserPrincipalName;\n\nSecurityEvent\n| where EventID in (4670, 4719, 4907)\n| extend ActionType = case(\n EventID == 4670, 'Object Permission Changed',\n EventID == 4719, 'System Audit Policy Changed',\n EventID == 4907, 'Audit Policy Changed',\n 'Other')\n| project TimeGenerated, Computer, Account, ActionType, Activity\n| where Account !in (SOX_Watchlist)\n| summarize TotalChanges = count(), AffectedSystems = make_set(Computer), AccountsInvolved = make_set(Account) by bin(TimeGenerated, 1d)\n| order by TimeGenerated desc\n| render timechart", "size": 3, "title": "Configuration or Sensitive Setting Changes in Financial Systems", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "tileSettings": { "showBorder": false }, "graphSettings": { "type": 0 } }, "name": "Configuration_Changes_in_Financial_Systems" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SOX_Watchlist = _GetWatchlist(\"SOX_Watchlist\") | project UserPrincipalName;\n\nlet WindowsChanges = SecurityEvent\n| where EventID in (4657, 4663)\n| where Account !in (SOX_Watchlist)\n| extend ChangeType = case(EventID == 4657, 'Registry Key Modified', 'File or Configuration Change')\n| project TimeGenerated, Computer, Account, ChangeType;\n\nlet LinuxChanges = Syslog\n| where SyslogMessage has_any ('config', 'modified', 'registry', 'updated', 'change')\n| where Account !in (SOX_Watchlist)\n| extend ChangeType = 'Linux Configuration Change'\n| project TimeGenerated, Computer, ChangeType;\n\nunion WindowsChanges, LinuxChanges\n| summarize ChangeCount = count() by ChangeType\n| render piechart", "size": 3, "title": "Configuration Change Distribution by Type (Windows & Linux)", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "showBorder": true }, "graphSettings": { "type": 0 } }, "name": "Configuration_Changes_PieChart" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SOX_Watchlist = _GetWatchlist(\"SOX_Watchlist\") | project UserPrincipalName;\n\nlet WindowsFIM = SecurityEvent\n| where EventID in (4663, 4656)\n| where ObjectName has_any ('.config', '.ini', '.xml', '.json', '.reg')\n| where Account !in (SOX_Watchlist)\n| extend ChangeSource = 'Windows FIM'\n| project TimeGenerated, Computer, ChangeSource;\n\nlet ThirdPartyFIM = CommonSecurityLog\n| where DeviceVendor has_any ('Microsoft', 'Tripwire', 'Qualys', 'CrowdStrike')\n| where Message has_any ('file modified', 'file changed', 'configuration changed')\n| where Account !in (SOX_Watchlist)\n| extend ChangeSource = '3rd-Party FIM'\n| project TimeGenerated, SourceHostName, DeviceVendor, ChangeSource;\n\nunion WindowsFIM, ThirdPartyFIM\n| summarize TotalChanges = count() by ChangeSource\n| render barchart", "size": 3, "title": "File Integrity Monitoring (FIM) — Change Distribution", "timeContext": { "durationMs": 53136000000, "endTime": "2025-11-11T09:08:00.000Z" }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "ChangeSource", "formatter": 1 }, "leftContent": { "columnMatch": "TotalChanges", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0 } }, "name": "FIM_Change_Distribution" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SOX_Watchlist = _GetWatchlist(\"SOX_Watchlist\") | project UserPrincipalName;\n\nunion isfuzzy=true\n(\n SecurityEvent\n | where EventID in (4657, 4663, 4739, 4719, 4907)\n | where Account !in (SOX_Watchlist)\n | extend SourceTable = 'SecurityEvent', ChangeDetail = Activity\n | project TimeGenerated, Computer, Account, EventID, ChangeDetail, SourceTable\n),\n(\n Syslog\n | where SyslogMessage has_any ('config', 'change', 'modified', 'updated', 'edit')\n | where Account !in (SOX_Watchlist)\n | extend SourceTable = 'Syslog', ChangeDetail = SyslogMessage\n | project TimeGenerated, Computer, HostName, ChangeDetail, SourceTable\n),\n(\n ConfigurationChange\n | extend SourceTable = 'ConfigurationChange', ChangeDetail = tostring(PropertyName)\n | where Account !in (SOX_Watchlist)\n | project TimeGenerated, Computer, ChangeCategory, ChangeDetail, SourceTable\n),\n(\n CommonSecurityLog\n | where Message has_any ('change', 'modified', 'configuration')\n | where Account !in (SOX_Watchlist)\n | extend SourceTable = 'CommonSecurityLog', ChangeDetail = Message\n | project TimeGenerated, DeviceVendor, DeviceProduct, ChangeDetail, SourceTable\n)\n| order by TimeGenerated desc", "size": 2, "title": "Detected Configuration or System Changes for Manual Cross-Check", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table" }, "conditionalVisibility": { "parameterName": "isChangeManagementVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Change_Management_Group" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SOX_Watchlist = _GetWatchlist(\"SOX_Watchlist\") | project UserPrincipalName;\n\n// 1 Detect audit log clearing (Windows Event ID 1102)\nSecurityEvent\n| where EventID == 1102 // Audit logs cleared\n| where Account !in (SOX_Watchlist)\n| extend SourceTable = \"SecurityEvent\", EventDescription = \"Windows Audit Log Cleared\"\n| project TimeGenerated, Computer, Account, EventDescription, SourceTable\n\n// 2️⃣ Detect sudden stoppage in logging from critical systems (no logs in expected time)\n| union (\n Heartbeat\n | where TimeGenerated < ago(1h) // No heartbeat in last hour\n | extend SourceTable = \"Heartbeat\", EventDescription = \"No recent logs (Possible Log Stoppage)\"\n | project TimeGenerated, Computer, EventDescription, SourceTable\n)\n\n// 3️⃣ Detect Defender or Syslog tampering\n| union (\n Syslog\n | where SyslogMessage has_any (\"logging stopped\", \"syslog stopped\", \"auditd stopped\", \"rsyslog stopped\")\n| where Account !in (SOX_Watchlist)\n | extend SourceTable = \"Syslog\", EventDescription = SyslogMessage\n | project TimeGenerated, HostName, EventDescription, SourceTable\n)\n| order by TimeGenerated desc", "size": 3, "title": "Logging Stoppage & Audit Log Tampering", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "tileSettings": { "showBorder": true, "titleContent": { "columnMatch": "SourceTable", "formatter": 1, "text": "Logging Stoppage & Audit Log Tampering" } }, "graphSettings": { "type": 0 } }, "name": "Logging_Stoppage_Audit_Log_Tampering" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SOX_Watchlist = _GetWatchlist(\"SOX_Watchlist\") | project UserPrincipalName;\n\nunion isfuzzy=true\n(\n SecurityEvent\n // EventID 1240: A security policy was changed\n // EventID 1241: A security setting was changed\n // EventID 1242: Audit policy change detected\n // EventID 4739: Domain policy was modified\n // EventID 4670: Permissions on an object were changed\n | where EventID in (1240, 1241, 1242, 4739, 4670)\n | where Account !in (SOX_Watchlist)\n | extend SourceSystem = \"Windows\"\n | project TimeGenerated, Computer, Account, Activity, EventID, SourceSystem,\n EventType = \"Security Event - Config Change\"\n),\n(\n Syslog\n // Detect database schema modifications or configuration file updates from Linux or DB logs\n | where SyslogMessage has_any (\"schema change\", \"ALTER TABLE\", \"CREATE TABLE\", \"DROP TABLE\", \"database modified\")\n | where Account !in (SOX_Watchlist)\n | extend SourceSystem = \"Linux/Database\"\n | project TimeGenerated, HostName, SyslogMessage, SourceSystem,\n EventType = \"Syslog - DB Schema Change\"\n)\n| summarize TotalChanges = count() by EventType\n| order by TotalChanges desc\n| render barchart", "size": 3, "title": "Unauthorized / Suspicious Config & DB Changes", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "showBorder": true, "titleContent": { "columnMatch": "EventType", "formatter": 1, "text": "Unauthorized / Suspicious Config & DB Changes" }, "leftContent": { "columnMatch": "TotalChanges", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0 } }, "name": "Unauthorized_Suspicious_Config_DB_Changes" } ] }, "conditionalVisibility": { "parameterName": "isChangeManagementVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Change Management Group" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Data Integrity & Audit Trail\nEnsure financial records and audit trails are protected from tampering and that data changes are observable and traceable. This section contains SOX-critical checks: audit log tampering, missing logs, unauthorized database/config changes, file integrity events, log-volume anomalies, and high-risk admin actions that could affect integrity." }, "name": "Data Integrity Description" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SOX_Watchlist = _GetWatchlist(\"SOX_Watchlist\") | project UserPrincipalName;\n\nunion isfuzzy=true (\n SecurityEvent\n | where EventID == 1102 // Windows Audit Log Cleared\n | where Account !in (SOX_Watchlist)\n | extend EventType='Windows Audit Log Cleared', Source='SecurityEvent'\n | project TimeGenerated, Source, Computer, EventType\n), (\n SecurityEvent\n | where EventID in (1100,1104) // Windows Logging Service Issue\n | where Account !in (SOX_Watchlist)\n | extend EventType='Windows Logging Service Issue', Source='SecurityEvent'\n | project TimeGenerated, Source, Computer, EventType\n), (\n Syslog\n | where SyslogMessage has_any ('logging stopped','auditd stopped','rsyslog stopped','syslog stopped')\n | where Account !in (SOX_Watchlist)\n | extend EventType='Syslog Logging Stopped', Source='Syslog'\n | project TimeGenerated, Source, HostName, EventType\n)\n| summarize TotalEvents=count() by EventType\n| order by TotalEvents desc\n| render barchart", "size": 3, "title": "Log Tampering & Audit Log Clearing", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "showBorder": true, "titleContent": { "columnMatch": "EventType", "formatter": 1, "text": "Log Tampering & Audit Log Clearing" }, "leftContent": { "columnMatch": "TotalEvents", "formatter": 12, "formatOptions": { "palette": "auto" } } }, "graphSettings": { "type": 0 } }, "name": "Log_Tampering_Audit_Log_Clearing" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SOX_Watchlist = _GetWatchlist(\"SOX_Watchlist\") | project UserPrincipalName;\n\nlet NoHeartbeat = Heartbeat\n| summarize LastHeartbeat = max(TimeGenerated) by Computer\n| where LastHeartbeat < ago(1h)\n| where Computer !in (SOX_Watchlist)\n| project Computer, LastHeartbeat, Issue = 'No recent heartbeat';\n\nlet NoSecurityEvents = SecurityEvent\n| summarize LastEvent = max(TimeGenerated) by Computer\n| where LastEvent < ago(1h)\n| where Computer !in (SOX_Watchlist)\n| project Computer, LastEvent, Issue = 'No recent SecurityEvent';\n\nNoHeartbeat\n| union NoSecurityEvents\n| summarize Count = count(), Issues = make_set(Issue) by Computer\n| order by Count desc\n| render table", "size": 3, "title": "Missing Logs / Log Stoppage", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "tileSettings": { "showBorder": true, "titleContent": { "columnMatch": "Computer", "formatter": 1, "text": "Missing Logs / Log Stoppage" } } }, "name": "Missing_Logs_Log_Stoppage" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SOX_Watchlist = _GetWatchlist(\"SOX_Watchlist\") | project UserPrincipalName;\n\nunion isfuzzy=true (\n Syslog\n | where SyslogMessage has_any ('ALTER TABLE','CREATE TABLE','DROP TABLE','schema change','database modified')\n | where HostName !in (SOX_Watchlist)\n | extend EventType='DB Schema/DB Modification', Source='Syslog'\n | project TimeGenerated, Source, HostName, EventType, Details=SyslogMessage\n), (\n SecurityEvent\n | where EventID in (4657,4663)\n | where tostring(ObjectName) has_any ('.config','.ini','.xml','.json','.reg')\n | where Computer !in (SOX_Watchlist)\n | extend EventType='Windows Config/File Change', Source='SecurityEvent'\n | project TimeGenerated, Source, Computer, EventType, Details=tostring(ObjectName)\n), (\n CommonSecurityLog\n | where Message has_any ('record modified','journal entry','transaction updated','financial entry','data change')\n | where SourceHostName !in (SOX_Watchlist)\n | extend EventType='Financial Application Audit Event', Source='CommonSecurityLog'\n | project TimeGenerated, Source, SourceHostName, EventType, Details=Message\n)\n| summarize TotalEvents=count(), Samples=make_set(Details,10) by EventType\n| order by TotalEvents desc\n| render piechart", "size": 3, "title": "Unauthorized DB / Config Changes", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "showBorder": true, "titleContent": { "columnMatch": "EventType", "formatter": 1, "text": "Unauthorized DB / Config Changes" } } }, "name": "Unauthorized_DB_Config_Changes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SOX_Watchlist = _GetWatchlist(\"SOX_Watchlist\") | project UserPrincipalName;\n\nunion isfuzzy=true (\n SecurityEvent\n | where EventID in (4663,4660) // File access or deletion\n | where ObjectName has_any ('xlsx','csv','txt','dat','bak')\n | where Account !in (SOX_Watchlist)\n | extend EventType='Financial Data File Access/Deletion', Source='SecurityEvent'\n | project TimeGenerated, Computer, EventType, Details=ObjectName\n), (\n Syslog\n | where SyslogMessage has_any ('file modified','file deleted','file tamper','checksum mismatch')\n | where HostName !in (SOX_Watchlist)\n | extend EventType='Linux File Integrity Issue', Source='Syslog'\n | project TimeGenerated, HostName, EventType, Details=SyslogMessage\n)\n| summarize TotalEvents=count(), Samples=make_set(Details,5) by EventType\n| order by TotalEvents desc\n| render table", "size": 3, "title": "Financial Data File Integrity (FIM Events)", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "tileSettings": { "showBorder": true, "titleContent": { "columnMatch": "EventType", "formatter": 1, "text": "Financial Data File Integrity (FIM Events)" } } }, "name": "Financial_Data_File_Integrity_FIM" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Daily log volume\r\nlet daily =\r\n SecurityEvent\r\n | summarize DailyCount = count() by bin(TimeGenerated, 1d)\r\n | extend JoinKey = 1 // dummy key for join\r\n | order by TimeGenerated asc;\r\n\r\n// Baseline values from entire dataset\r\nlet baseline =\r\n daily\r\n | summarize AvgCount = avg(DailyCount), StdDev = stdev(DailyCount)\r\n | extend JoinKey = 1; // dummy key for join\r\n\r\n// Join daily counts with baseline\r\ndaily\r\n| join kind=inner baseline on JoinKey\r\n| extend UpperLimit = AvgCount + (StdDev * 2),\r\n LowerLimit = AvgCount - (StdDev * 2)\r\n| extend Anomaly = iff(DailyCount < LowerLimit or DailyCount > UpperLimit, \"Yes\", \"No\")\r\n| project TimeGenerated, DailyCount, AvgCount, UpperLimit, LowerLimit, Anomaly\r\n| order by TimeGenerated desc\r\n", "size": 3, "title": "Log Volume Anomalies (Possible Tampering / Suppression)", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "area" }, "name": "LogVolumeAnomalies" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SOX_Watchlist = _GetWatchlist(\"SOX_Watchlist\") | project UserPrincipalName;\n\nunion isfuzzy=true (\n SecurityEvent\n | where EventID in (4720,4726,4732,4754) // High-risk admin actions\n | where Account !in (SOX_Watchlist)\n | extend EventType='High-Risk Admin Action', Source='SecurityEvent'\n | project TimeGenerated, Source, Computer, EventType, Details=tostring(EventID)\n), (\n AzureActivity\n | where OperationName has_any ('role assignment','role update','directory write','policy update')\n | where Caller !in (SOX_Watchlist)\n | extend EventType='Azure Role/Policy Change', Source='AzureActivity'\n | project TimeGenerated, Caller, EventType, Details=OperationName\n)\n| summarize TotalEvents=count(), Actors=make_set(Caller,10) by EventType\n| order by TotalEvents desc\n| render barchart", "size": 3, "title": "High-Risk Admin Actions Impacting Data Integrity", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "tileSettings": { "showBorder": true, "titleContent": { "columnMatch": "EventType", "formatter": 1, "text": "High-Risk Admin Actions" } } }, "name": "High_Risk_Admin_Actions" } ] }, "conditionalVisibility": { "parameterName": "isDataIntegrityVisible", "comparison": "isEqualTo", "value": "true" }, "name": "Data Integrity Group" } ], "fromTemplateId": "", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }