{ "version": "Notebook/1.0", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "d95ba1a4-a2d5-43d2-8129-b6be85a7602d", "cellValue": "dashboard", "linkTarget": "parameter", "linkLabel": "Detections", "subTarget": "Detections", "style": "link" }, { "id": "34cb8aa2-5e2d-4177-8568-9baf4b57cf07", "cellValue": "dashboard", "linkTarget": "parameter", "linkLabel": "Security Alerts", "subTarget": "Security Alerts", "style": "link" } ] }, "name": "links - 0" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": ">**NOTE:** This workbook depends on a parser based on a Kusto Function to work as expected [**ExtraHopDetections**](https://aka.ms/sentinel-ExtraHopDetections-parser) which is deployed with the Microsoft Sentinel Solution." }, "name": "text - 5" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "59c79f5b-f70b-4efb-a1c5-61415c94e007", "version": "KqlParameterItem/1.0", "name": "Time", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 1800000 }, "value": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ExtraHopDetections\r\n| where IsRecommended == true | count", "size": 3, "showAnalytics": true, "title": "Recommended Detections", "timeContextFromParameter": "Time", "showRefreshButton": true, "exportFieldName": "Count", "exportParameterName": "RecommendedDetails", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": -1, "palette": "blue" } }, "showBorder": true } }, "customWidth": "33", "name": "query - 0", "styleSettings": { "margin": "5px", "maxWidth": "33%" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ExtraHopDetections\r\n| count", "size": 3, "showAnalytics": true, "title": "Total Detections", "timeContextFromParameter": "Time", "showRefreshButton": true, "exportFieldName": "Count", "exportParameterName": "DetectionDetails", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": -1, "palette": "magenta" } }, "showBorder": true } }, "customWidth": "33", "name": "query - 1", "styleSettings": { "margin": "5px", "maxWidth": "33%" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ExtraHopDetections\r\n| summarize MaximumRiskScore=max(RiskScore)", "size": 3, "showAnalytics": true, "title": "Maximum Risk Score", "timeContextFromParameter": "Time", "showRefreshButton": true, "exportFieldName": "MaximumRiskScore", "exportParameterName": "MaximumRiskScore", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "MaximumRiskScore", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "0", "representation": "gray", "text": "{0}{1}" }, { "operator": "<=", "thresholdValue": "30", "representation": "yellow", "text": "{0}{1}" }, { "operator": "<=", "thresholdValue": "79", "representation": "orange", "text": "{0}{1}" }, { "operator": "<=", "thresholdValue": "99", "representation": "redBright", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "lightBlue", "text": "{0}{1}" } ] } }, "showBorder": true } }, "customWidth": "33", "name": "query - 1", "styleSettings": { "margin": "5px", "maxWidth": "33%" } }, { "type": 1, "content": { "json": "#### Click on the sections in the above panel **Recommended Detections** to view more information.", "style": "info" }, "customWidth": "33", "name": "text - 5", "styleSettings": { "margin": "5px", "maxWidth": "33%" } }, { "type": 1, "content": { "json": "#### Click on the sections in the above panel **Total Detections** to view more information.", "style": "info" }, "customWidth": "33", "name": "text - 7", "styleSettings": { "margin": "5px", "maxWidth": "33%" } }, { "type": 1, "content": { "json": "#### Click on the sections in the above panel **Maximum Risk Score** to view more information.", "style": "info" }, "customWidth": "33", "name": "text - 8", "styleSettings": { "margin": "5px", "maxWidth": "33%" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ExtraHopDetections\r\n| where IsRecommended = true \r\n| extend SourceDeviceIpAddress = strcat_array(todynamic(SourceDeviceIpAddress), \",\"), DestinationDeviceIpAddress = strcat_array(todynamic(DestinationDeviceIpAddress), \",\"),\r\nCategoriesIds = strcat_array(todynamic(CategoriesIds), \",\"),\r\nCategories = strcat_array(todynamic(Categories), \",\"),\r\nTechniqueIds = strcat_array(todynamic(TechniqueIds), \",\"),\r\nTechniqueNames = strcat_array(todynamic(TechniqueNames), \",\")\r\n| project-reorder TimeGenerated, Title, IsRecommended", "size": 0, "showAnalytics": true, "title": "Details of Recommended Detections", "noDataMessage": "No data found.", "timeContextFromParameter": "Time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "RecommendedDetails", "comparison": "isNotEqualTo" }, "name": "query - 3", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ExtraHopDetections\r\n| extend SourceDeviceIpAddress = strcat_array(todynamic(SourceDeviceIpAddress), \",\"), DestinationDeviceIpAddress = strcat_array(todynamic(DestinationDeviceIpAddress), \",\"),\r\nCategoriesIds = strcat_array(todynamic(CategoriesIds), \",\"),\r\nCategories = strcat_array(todynamic(Categories), \",\"),\r\nTechniqueIds = strcat_array(todynamic(TechniqueIds), \",\"),\r\nTechniqueNames = strcat_array(todynamic(TechniqueNames), \",\")", "size": 0, "showAnalytics": true, "title": "Details of Detections", "noDataMessage": "No data found.", "timeContextFromParameter": "Time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "DetectionDetails", "comparison": "isNotEqualTo" }, "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ExtraHopDetections\r\n| where RiskScore == ('{MaximumRiskScore}')\r\n| extend SourceDeviceIpAddress = strcat_array(todynamic(SourceDeviceIpAddress), \",\"), DestinationDeviceIpAddress = strcat_array(todynamic(DestinationDeviceIpAddress), \",\"),\r\nCategoriesIds = strcat_array(todynamic(CategoriesIds), \",\"),\r\nCategories = strcat_array(todynamic(Categories), \",\"),\r\nTechniqueIds = strcat_array(todynamic(TechniqueIds), \",\"),\r\nTechniqueNames = strcat_array(todynamic(TechniqueNames), \",\")\r\n| project-reorder TimeGenerated, Title, RiskScore", "size": 0, "showAnalytics": true, "title": "Details of Detections with Risk Score: {MaximumRiskScore}", "noDataMessage": "No data found.", "timeContextFromParameter": "Time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "MaximumRiskScore", "comparison": "isNotEqualTo" }, "name": "query - 5", "styleSettings": { "showBorder": true } } ] }, "name": "group - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ExtraHopDetections \r\n| where IsRecommended = true\r\n| summarize Count = count() by Title | project-rename [\"Detection Title\"] = Title", "size": 0, "showAnalytics": true, "title": "Recommended Detections", "noDataMessage": "No data found.", "timeContextFromParameter": "Time", "showRefreshButton": true, "exportFieldName": "Detection Title", "exportParameterName": "DetectionTitle", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000 } }, "customWidth": "33", "name": "query - 1", "styleSettings": { "margin": "5px", "maxWidth": "33%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ExtraHopDetections\r\n| mv-expand todynamic(CategoriesIds) | summarize Count = count() by tostring(CategoriesIds) | top 10 by Count", "size": 0, "showAnalytics": true, "title": "Top Detection Categories", "timeContextFromParameter": "Time", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "CategoryId", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "CategoriesIds", "createOtherGroup": 10 } }, "customWidth": "33", "name": "query - 2", "styleSettings": { "margin": "5px", "maxWidth": "33%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ExtraHopDetections\r\n| mv-expand todynamic(TechniqueNames)\r\n| summarize Count=count() by tostring(TechniqueNames)\r\n| project-rename [\"MITRE Category\"] = TechniqueNames\r\n| top 10 by Count", "size": 0, "showAnalytics": true, "title": "Top MITRE Techniques", "noDataMessage": "No data found.", "timeContextFromParameter": "Time", "showRefreshButton": true, "exportFieldName": "MITRE Category", "exportParameterName": "MITRECategory", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "query - 2", "styleSettings": { "margin": "5px", "maxWidth": "33%", "showBorder": true } }, { "type": 1, "content": { "json": "#### Click on the sections in the above panel **Recommended Detections** to view more information.", "style": "info" }, "customWidth": "33", "name": "text - 6", "styleSettings": { "margin": "5px", "maxWidth": "33%" } }, { "type": 1, "content": { "json": "#### Click on the sections in the above panel **Top Detection Categories** to view more information.", "style": "info" }, "customWidth": "33", "name": "text - 7", "styleSettings": { "margin": "5px", "maxWidth": "33%" } }, { "type": 1, "content": { "json": "#### Click on the sections in the above panel **Top MITRE Techniques** to view more information.", "style": "info" }, "customWidth": "33", "name": "text - 8", "styleSettings": { "margin": "5px", "maxWidth": "33%" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ExtraHopDetections\r\n| where Title == ('{DetectionTitle}')\r\n| extend SourceDeviceIpAddress = strcat_array(todynamic(SourceDeviceIpAddress), \",\"), DestinationDeviceIpAddress = strcat_array(todynamic(DestinationDeviceIpAddress), \",\"),\r\nCategoriesIds = strcat_array(todynamic(CategoriesIds), \",\"),\r\nCategories = strcat_array(todynamic(Categories), \",\"),\r\nTechniqueIds = strcat_array(todynamic(TechniqueIds), \",\"),\r\nTechniqueNames = strcat_array(todynamic(TechniqueNames), \",\")", "size": 0, "showAnalytics": true, "title": "Details of Detection for {DetectionTitle}", "noDataMessage": "No data found.", "timeContextFromParameter": "Time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "DetectionTitle", "comparison": "isNotEqualTo" }, "name": "query - 5", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ExtraHopDetections\r\n| where CategoriesIds has_any (\"{CategoryId}\") \r\n| extend SourceDeviceIpAddress = strcat_array(todynamic(SourceDeviceIpAddress), \",\"), DestinationDeviceIpAddress = strcat_array(todynamic(DestinationDeviceIpAddress), \",\"),\r\nCategoriesIds = strcat_array(todynamic(CategoriesIds), \",\"),\r\nCategories = strcat_array(todynamic(Categories), \",\"),\r\nTechniqueIds = strcat_array(todynamic(TechniqueIds), \",\"),\r\nTechniqueNames = strcat_array(todynamic(TechniqueNames), \",\")\r\n| project-reorder TimeGenerated, Title, CategoriesIds, Categories", "size": 0, "showAnalytics": true, "title": "Details of Detections for Category ID: {CategoryId}", "noDataMessage": "No data found.", "timeContextFromParameter": "Time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "CategoryId", "comparison": "isNotEqualTo" }, "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ExtraHopDetections\r\n| where TechniqueNames has_any (\"{MITRECategory}\")\r\n| extend SourceDeviceIpAddress = strcat_array(todynamic(SourceDeviceIpAddress), \",\"), DestinationDeviceIpAddress = strcat_array(todynamic(DestinationDeviceIpAddress), \",\"),\r\nCategoriesIds = strcat_array(todynamic(CategoriesIds), \",\"),\r\nCategories = strcat_array(todynamic(Categories), \",\"),\r\nTechniqueIds = strcat_array(todynamic(TechniqueIds), \",\"),\r\nTechniqueNames = strcat_array(todynamic(TechniqueNames), \",\")\r\n| project-rename [\"MITRETechniqueNames\"] = TechniqueNames\r\n| project-reorder TimeGenerated, Title, MITRETechniqueNames", "size": 0, "showAnalytics": true, "title": "Details of {MITRECategory} MITRE Category", "noDataMessage": "No data found.", "timeContextFromParameter": "Time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "MITRECategory", "comparison": "isNotEqualTo" }, "name": "query - 5", "styleSettings": { "showBorder": true } } ] }, "customWidth": "0", "name": "group - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ExtraHopDetections\r\n| summarize Count=count() by SourceHostname\r\n| project-rename [\"Host\"] = SourceHostname\r\n| top 10 by Count", "size": 0, "showAnalytics": true, "title": "Top Sources", "noDataMessage": "No data found.", "timeContextFromParameter": "Time", "showRefreshButton": true, "exportFieldName": "Host", "exportParameterName": "SourceHostname", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "query - 2", "styleSettings": { "margin": "5px", "maxWidth": "33%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ExtraHopDetections\r\n| summarize Count=count() by DestinationHostname\r\n| project-rename [\"Host\"] = DestinationHostname\r\n| top 10 by Count", "size": 0, "showAnalytics": true, "title": "Top Destinations", "noDataMessage": "No data found.", "timeContextFromParameter": "Time", "showRefreshButton": true, "exportFieldName": "Host", "exportParameterName": "DestinationHostname", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "33", "name": "query - 3", "styleSettings": { "margin": "5px", "maxWidth": "33%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ExtraHopDetections \r\n| summarize Count = count() by SourceHostname, DestinationHostname ", "size": 0, "showAnalytics": true, "title": "Sources and Destinations", "timeContextFromParameter": "Time", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "SourceHostname", "parameterName": "SourceHostName", "parameterType": 1 }, { "fieldName": "DestinationHostname", "parameterName": "DestinationHostName", "parameterType": 1 } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000 } }, "customWidth": "33", "name": "query - 6", "styleSettings": { "margin": "5px", "maxWidth": "33%", "showBorder": true } }, { "type": 1, "content": { "json": "#### Click on the sections in the above panel **Top Sources** to view more information.", "style": "info" }, "customWidth": "33", "name": "text - 4", "styleSettings": { "margin": "5px", "maxWidth": "33%" } }, { "type": 1, "content": { "json": "#### Click on the sections in the above panel **Top Destinations** to view more information.", "style": "info" }, "customWidth": "33", "name": "text - 5", "styleSettings": { "margin": "5px", "maxWidth": "33%" } }, { "type": 1, "content": { "json": "#### Click on the sections in the above panel **Sources and Destinations** to view more information.", "style": "info" }, "customWidth": "33", "name": "text - 8", "styleSettings": { "margin": "5px", "maxWidth": "33%" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ExtraHopDetections\r\n| where SourceHostname == (\"{SourceHostname}\") \r\n| extend SourceDeviceIpAddress = strcat_array(todynamic(SourceDeviceIpAddress), \",\"), DestinationDeviceIpAddress = strcat_array(todynamic(DestinationDeviceIpAddress), \",\"),\r\nCategoriesIds = strcat_array(todynamic(CategoriesIds), \",\"),\r\nCategories = strcat_array(todynamic(Categories), \",\"),\r\nTechniqueIds = strcat_array(todynamic(TechniqueIds), \",\"),\r\nTechniqueNames = strcat_array(todynamic(TechniqueNames), \",\")\r\n| project-reorder TimeGenerated, Title, SourceHostname", "size": 0, "showAnalytics": true, "title": "Details of {SourceHostname} Source", "noDataMessage": "No data found.", "timeContextFromParameter": "Time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "SourceHostname", "comparison": "isNotEqualTo" }, "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ExtraHopDetections\r\n| where DestinationHostname == (\"{DestinationHostname}\") \r\n| extend SourceDeviceIpAddress = strcat_array(todynamic(SourceDeviceIpAddress), \",\"), DestinationDeviceIpAddress = strcat_array(todynamic(DestinationDeviceIpAddress), \",\"),\r\nCategoriesIds = strcat_array(todynamic(CategoriesIds), \",\"),\r\nCategories = strcat_array(todynamic(Categories), \",\"),\r\nTechniqueIds = strcat_array(todynamic(TechniqueIds), \",\"),\r\nTechniqueNames = strcat_array(todynamic(TechniqueNames), \",\")\r\n| project-reorder TimeGenerated, Title, DestinationHostname", "size": 0, "showAnalytics": true, "title": "Details of {DestinationHostname} Destination", "noDataMessage": "No data found.", "timeContextFromParameter": "Time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "DestinationHostname", "comparison": "isNotEqualTo" }, "name": "query - 3", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ExtraHopDetections \r\n| where SourceHostname == (\"{SourceHostName}\") and DestinationHostname == (\"{DestinationHostName}\")\r\n| extend SourceDeviceIpAddress = strcat_array(todynamic(SourceDeviceIpAddress), \",\"), DestinationDeviceIpAddress = strcat_array(todynamic(DestinationDeviceIpAddress), \",\"),\r\nCategoriesIds = strcat_array(todynamic(CategoriesIds), \",\"),\r\nCategories = strcat_array(todynamic(Categories), \",\"),\r\nTechniqueIds = strcat_array(todynamic(TechniqueIds), \",\"),\r\nTechniqueNames = strcat_array(todynamic(TechniqueNames), \",\")\r\n| project-reorder TimeGenerated, Title, SourceHostname, DestinationHostname", "size": 0, "showAnalytics": true, "title": "Details of {SourceHostName} and {DestinationHostName}", "timeContextFromParameter": "Time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibilities": [ { "parameterName": "SourceHostName", "comparison": "isNotEqualTo" }, { "parameterName": "DestinationHostName", "comparison": "isNotEqualTo" } ], "name": "query - 7" } ] }, "name": "group - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ExtraHopDetections\r\n| sort by TimeGenerated\r\n| extend CategoriesIds = strcat_array(todynamic(CategoriesIds), \",\")\r\n| project TimeGenerated, [\"Detection ID\"] = Id, [\"Risk Score\"] = RiskScore, [\"Detection Title\"] = Title, [\"Categories\"] = CategoriesIds, \r\n[\"Source Host\"] = SourceHostname, [\"Destination Host\"] = DestinationHostname, [\"Detection Generated Time\"] = DateTime, [\"Detection URL\"] = Url", "size": 0, "showAnalytics": true, "title": "Recent Detections", "noDataMessage": "No data found.", "timeContextFromParameter": "Time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "📝 **Refresh the web page to fetch details of recently collected events**" }, "name": "text - 6" } ] }, "conditionalVisibility": { "parameterName": "dashboard", "comparison": "isEqualTo", "value": "Detections" }, "name": "group - 6" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": ">This dashboard shows Microsoft Sentinel Security Alerts data for ExtraHop by various views.\n" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "08f97f34-6264-4fa3-90b5-16b89422d285", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "value": { "durationMs": 86400000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] } }, { "id": "cd98a9c7-5dbd-4f92-a967-7ed1c781132a", "version": "KqlParameterItem/1.0", "name": "AlertSeverity", "type": 2, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityAlert\r\n| summarize Count = count() by AlertSeverity\r\n| order by Count desc, AlertSeverity asc\r\n| project Value = AlertSeverity, Label = strcat(AlertSeverity, ' - ', Count)", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "label": "Alert Severity" }, { "id": "9636b674-c842-4c91-b7a8-68c297b21754", "version": "KqlParameterItem/1.0", "name": "MITRETechnique", "type": 2, "isRequired": true, "quote": "'", "delimiter": ",", "query": "SecurityAlert\r\n| where ProductName == \"ExtraHop\"\r\n| mv-expand MITRETechnique = todynamic(Techniques)\r\n| distinct tostring(MITRETechnique)\r\n| sort by tostring(MITRETechnique)", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "label": "MITRE Technique" }, { "id": "d6ab142d-62c9-4c21-befc-b9107d5d8187", "version": "KqlParameterItem/1.0", "name": "MITRETactic", "type": 2, "isRequired": true, "quote": "'", "delimiter": ",", "query": "SecurityAlert\r\n| where ProductName == \"ExtraHop\"\r\n| extend Tactics_list = split(Tactics, \", \")\r\n| mv-expand Tactics = Tactics_list\r\n| where isnotempty(Tactics)\r\n| distinct tostring(Tactics)\r\n| sort by Tactics asc\r\n\r\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "label": "MITRE Tactic" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let data = SecurityAlert\n| where \"{AlertSeverity:label}\" == \"All\" or AlertSeverity in ({AlertSeverity})\n| where \"{MITRETactic:label}\" == \"All\" or Tactics contains ('{MITRETactic}')\n| where\"{MITRETechnique:label}\" == \"All\" or Techniques has_any ('{MITRETechnique}')\n| where ProductName == \"ExtraHop\";\ndata\n| summarize Count = count() by AlertSeverity\n| join kind = inner (data\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AlertSeverity)\n on AlertSeverity\n | project-away TimeGenerated\n| extend AlertSeveritys = AlertSeverity\n| union (\n data \n | summarize Count = count() \n | extend jkey = 1\n | join kind=inner (data\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\n | extend jkey = 1) on jkey\n | extend AlertSeverity = 'All', AlertSeveritys = '*' \n)\n| extend Severity = iif(AlertSeverity == \"All\", 0,iif(AlertSeverity == \"High\", 1, iif(AlertSeverity == \"Medium\", 2, iif(AlertSeverity == \"Low\", 3, 4))))\n| order by Severity asc\n", "size": 3, "showAnalytics": true, "title": "Security Alerts by Severity", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "AlertSeverity", "exportParameterName": "AlertSeverityPicker", "exportDefaultValue": "All", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "AlertSeverity", "formatter": 1, "formatOptions": { "showIcon": true } }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "showIcon": true }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "showIcon": true } }, "showBorder": false, "sortOrderField": 1 } }, "name": "SecurityAlertsbySeverity" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let interval_in_hrs= datetime_diff('hour', {TimeRange:end}, {TimeRange:start});\r\nlet interval_in_days= datetime_diff('day', {TimeRange:end}, {TimeRange:start});\r\nlet bin_duration=case(interval_in_hrs<=24, 1h, interval_in_days<=30, 1d, interval_in_days>=31 and interval_in_days<=90, 7d, 31d);\r\nSecurityAlert\r\n| where \"{AlertSeverity:label}\" == \"All\" or AlertSeverity in ({AlertSeverity})\r\n| where \"{MITRETactic:label}\" == \"All\" or Tactics contains ('{MITRETactic}')\r\n| where\"{MITRETechnique:label}\" == \"All\" or Techniques has_any ('{MITRETechnique}')\r\n| where ProductName == \"ExtraHop\"\r\n| where AlertSeverity == '{AlertSeverityPicker}' or '{AlertSeverityPicker}' == \"All\"\r\n| summarize count() by AlertSeverity, bin(TimeGenerated, bin_duration)\r\n", "size": 3, "showAnalytics": true, "title": "Security Alerts Over Time by Severity", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "linechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Medium", "color": "orange" }, { "seriesName": "Low", "color": "yellow" }, { "seriesName": "Informational", "color": "gray" }, { "seriesName": "High", "color": "red" } ] } }, "name": "SecurityAlertsOverTimebySeverity" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityAlert\r\n| where \"{AlertSeverity:label}\" == \"All\" or AlertSeverity in ({AlertSeverity})\r\n| where \"{MITRETactic:label}\" == \"All\" or Tactics contains ('{MITRETactic}')\r\n| where\"{MITRETechnique:label}\" == \"All\" or Techniques has_any ('{MITRETechnique}')\r\n| where ProductName == \"ExtraHop\"\r\n| where AlertSeverity == '{AlertSeverityPicker}' or '{AlertSeverityPicker}' == \"All\"\r\n| extend Entities = iff(isempty(Entities), todynamic('[{\"dummy\" : \"\"}]'), todynamic(Entities))\r\n| mvexpand Entities\r\n| evaluate bag_unpack(Entities, \"Entity_\")\r\n| extend Entity_Type = columnifexists(\"Entity_Type\", \"\")\r\n| extend Entity_Name = columnifexists(\"Entity_Name\", \"\")\r\n| extend Entity_ResourceId = columnifexists(\"Entity_ResourceId\", \"\")\r\n| extend Entity_Directory = columnifexists(\"Entity_Directory\", \"\")\r\n| extend Entity_Value = columnifexists(\"Entity_Value\", \"\")\r\n| extend Entity_HostName = columnifexists(\"Entity_HostName\", \"\")\r\n| extend Entity_Address = columnifexists(\"Entity_Address\", \"\")\r\n| extend Entity_ProcessId = columnifexists(\"Entity_ProcessId\", \"\")\r\n| extend Entity_Url = columnifexists(\"Entity_Url\", \"\")\r\n| extend Target = iif(Entity_Type == \"account\", Entity_Name, iif(Entity_Type == \"azure-resource\", Entity_ResourceId, iif(Entity_Type == \"cloud-application\", Entity_Name, iif(Entity_Type == \"dns\", Entity_Name, iif(Entity_Type == \"file\", strcat(Entity_Directory, \"\\\\\", Entity_Name), iif(Entity_Type == \"filehash\", Entity_Value, iif(Entity_Type == \"host\", Entity_HostName, iif(Entity_Type == \"ip\" , Entity_Address, iif(Entity_Type == \"malware\", Entity_HostName, iif(Entity_Type == \"network-connection\", Entity_Name, iif(Entity_Type == \"process\", Entity_ProcessId, iif(Entity_Type == \"registry-key\", Entity_Name, iif(Entity_Type == \"registry-value\", Entity_Name, iif(Entity_Type == \"security-group\", Entity_Name, iif(Entity_Type == \"url\", Entity_Url, \"NoTarget\")))))))))))))))\r\n| where Entity_Type in (\"account\", \"host\", \"ip\", \"url\", \"azure-resource\", \"cloud-application\", \"dns\", \"file\", \"filehash\", \"malware\", \"network-connection\", \"process\", \"registry-key\", \"registry-value\", \"security-group\")\r\n| summarize Count = count() by Target, Entity_Type\r\n| order by Count desc\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Top Entities in Security Alerts", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "TopEntitiesinSecurityAlerts", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityAlert\r\n| where \"{AlertSeverity:label}\" == \"All\" or AlertSeverity in ({AlertSeverity})\r\n| where \"{MITRETactic:label}\" == \"All\" or Tactics contains ('{MITRETactic}')\r\n| where\"{MITRETechnique:label}\" == \"All\" or Techniques has_any ('{MITRETechnique}')\r\n| where ProductName == \"ExtraHop\"\r\n| where AlertSeverity == '{AlertSeverityPicker}' or '{AlertSeverityPicker}' == \"All\"\r\n| extend Entities = iff(isempty(Entities), todynamic('[{\"dummy\" : \"\"}]'), todynamic(Entities))\r\n| mvexpand Entities\r\n| evaluate bag_unpack(Entities, \"Entity_\")\r\n| extend Entity_Type = columnifexists(\"Entity_Type\", \"\")\r\n| where Entity_Type in (\"account\", \"alerts\", \"azure-resource\", \"cloud-application\", \"dns\", \"file\", \"filehash\", \"host\", \"host-logon-session\", \"ip\", \"malware\", \"network-connection\", \"process\", \"registry-key\", \"registry-value\", \"security-group\", \"SrvSvcSessionEntry\", \"url\")\r\n| summarize count() by Entity_Type\r\n| order by count_ desc", "size": 0, "showAnalytics": true, "title": "Count of Entities in Security Alerts by Type", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "unstackedbar" }, "name": "CountofEntitiesinSecurityAlertsbyType" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityAlert\r\n| where \"{AlertSeverity:label}\" == \"All\" or AlertSeverity in ({AlertSeverity})\r\n| where \"{MITRETactic:label}\" == \"All\" or Tactics contains ('{MITRETactic}')\r\n| where \"{MITRETechnique:label}\" == \"All\" or Techniques has_any ('{MITRETechnique}')\r\n| where ProductName == \"ExtraHop\"\r\n| mv-expand todynamic(Techniques)\r\n| where \"{MITRETechnique:label}\" == \"All\" or Techniques == '{MITRETechnique}'\r\n| summarize Count=count() by tostring(Techniques)\r\n| sort by Count desc", "size": 0, "showAnalytics": true, "title": "Top MITRE Techniques in Security Alerts", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "customWidth": "50", "name": "query - 7", "styleSettings": { "margin": "5px", "maxWidth": "50%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityAlert\r\n| where \"{AlertSeverity:label}\" == \"All\" or AlertSeverity in ({AlertSeverity})\r\n| where \"{MITRETactic:label}\" == \"All\" or Tactics contains ('{MITRETactic}')\r\n| where\"{MITRETechnique:label}\" == \"All\" or Techniques has_any ('{MITRETechnique}')\r\n| where ProductName == \"ExtraHop\"\r\n| extend Tactics_list = split(Tactics, \", \")\r\n| mv-expand Tactics = Tactics_list\r\n| where isnotempty(Tactics)\r\n| where \"{MITRETactic:label}\" == \"All\" or Tactics == ('{MITRETactic}')\r\n| summarize Count = count() by tostring(Tactics)\r\n| sort by Count desc\r\n", "size": 0, "showAnalytics": true, "title": "Top MITRE Tactics in Security Alerts", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "customWidth": "50", "name": "query - 6", "styleSettings": { "margin": "5px", "maxWidth": "50%", "showBorder": true } }, { "type": 1, "content": { "json": "📝 **Refresh the web page to fetch details of recently collected alerts**" }, "name": "text - 8" } ] }, "conditionalVisibility": { "parameterName": "dashboard", "comparison": "isEqualTo", "value": "Security Alerts" }, "name": "group - 2" } ], "fromTemplateId": "sentinel-ExtraHopDetectionsOverview", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }