{ "version": "Notebook/1.0", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "36eea26a-45af-4622-b95f-d7342cb71417", "cellValue": "setTab", "linkTarget": "parameter", "linkLabel": "SOC Overview", "subTarget": "SOC Overview", "style": "link" }, { "id": "9684bccd-cbc3-4e97-9779-73a282bd2dd3", "cellValue": "setTab", "linkTarget": "parameter", "linkLabel": "Threat Inspection", "subTarget": "Threat Inspection", "style": "link" }, { "id": "ab231130-8792-4feb-850d-7f9d418c1c90", "cellValue": "setTab", "linkTarget": "parameter", "linkLabel": "Flow Analysis", "subTarget": "Flow Analysis", "style": "link" } ] }, "name": "links - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# SOC Overview\r\n\r\nIt is designed to provide insight into the security operations center (SOC) based on key metrics, workflows, and dispositions so that you can monitor the efficiency of the SOC and ensure that all security operations (detections, analysis, and responses) are on track." }, "name": "text - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "7d22e45d-e280-44d6-b766-13111e69d885", "version": "KqlParameterItem/1.0", "name": "time_range", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 86400000 } }, { "id": "98b9186b-1d73-453c-a4f3-bff6c1dc0d78", "version": "KqlParameterItem/1.0", "name": "source_router", "label": "Source Router", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD\r\n| union CiscoSDWANNetflow\r\n| where isnotempty(Host) or isnotempty(NetflowHostname)\r\n| extend hosts = coalesce(Host, NetflowHostname)\r\n| distinct hosts\r\n| sort by hosts asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": "value::all" }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 2" }, { "type": 1, "content": { "json": "πŸ’‘ Click on the data points in the each of the below panels to view more details.\r\n\r\n" }, "name": "text - 39" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSyslogUTD\r\n| where (isnotempty(Classification) or (isnotempty(Malware) and Malware != \"None\"))\r\n| where '*' == '{source_router}' or Host == '{source_router}'\r\n| extend Threat = coalesce(Classification, Malware)\r\n| summarize count() by Threat\r\n| sort by count_\r\n| limit 10", "size": 3, "showAnalytics": true, "title": "Top 10 Threats", "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "threat", "exportDefaultValue": "None", "exportToExcelOptions": "all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "yAxis": [ "count_" ], "group": "Threat", "createOtherGroup": 10 } }, "customWidth": "50", "name": "query - 0", "styleSettings": { "padding": "0px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSyslogUTD\r\n| where (isnotempty(Classification) or (isnotempty(Malware) and Malware != \"None\"))\r\n| where '*' == '{source_router}' or Host == '{source_router}'\r\n| summarize count() by System_IP\r\n| sort by count_\r\n| limit 10", "size": 3, "showAnalytics": true, "title": "Top 10 Devices by Threat", "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "device", "exportDefaultValue": "None", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "System_IP", "createOtherGroup": 10 } }, "customWidth": "50", "name": "query - 1", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### Threat Details for \"{threat}\"" }, "conditionalVisibility": { "parameterName": "threat", "comparison": "isNotEqualTo", "value": "None" }, "name": "text - 20" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "7660c654-705e-4fd4-826a-92236babaf2c", "version": "KqlParameterItem/1.0", "name": "device_ip", "label": "Device IP", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD\r\n| where (isnotempty(Classification) or (isnotempty(Malware) and Malware != \"None\"))\r\n| where '*' == '{source_router}' or Host == '{source_router}'\r\n| extend Threat = coalesce(Classification, Malware)\r\n| where Threat == '{threat}'\r\n| distinct System_IP\r\n| order by System_IP asc\r\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": "value::all" }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "7760355d-a483-4a19-b4de-19bf94d6d4b6", "version": "KqlParameterItem/1.0", "name": "device_name", "label": "Device Name", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD\r\n| where (isnotempty(Classification) or (isnotempty(Malware) and Malware != \"None\"))\r\n| where '*' == '{source_router}' or Host == '{source_router}'\r\n| extend Threat = coalesce(Classification, Malware)\r\n| where Threat == '{threat}'\r\n| distinct Hostname\r\n| order by Hostname asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": "value::all" }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "c37acb94-48b9-4590-b910-ccb4941c1326", "version": "KqlParameterItem/1.0", "name": "action", "label": "Action", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD\r\n| where (isnotempty(Classification) or (isnotempty(Malware) and Malware != \"None\"))\r\n| where '*' == '{source_router}' or Host == '{source_router}'\r\n| extend Threat = coalesce(Classification, Malware)\r\n| where Threat == '{threat}'\r\n| distinct Action\r\n| order by Action asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": "value::all" }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "7543b97f-3c7f-4d79-ac0f-8484b21184ef", "version": "KqlParameterItem/1.0", "name": "src_ip", "label": "Source IP", "type": 1, "timeContext": { "durationMs": 604800000 }, "defaultValue": "", "timeContextFromParameter": "time_range", "value": "*" }, { "id": "d134d35a-2b1a-4506-8326-83d666dcda08", "version": "KqlParameterItem/1.0", "name": "src_port", "label": "Source Port", "type": 1, "timeContext": { "durationMs": 0 }, "defaultValue": "", "timeContextFromParameter": "time_range", "value": "*" }, { "id": "df13f5d5-3a86-479e-b292-859f56e6711b", "version": "KqlParameterItem/1.0", "name": "dest_ip", "label": "Destination IP", "type": 1, "timeContext": { "durationMs": 0 }, "defaultValue": "*", "timeContextFromParameter": "time_range", "value": "*" }, { "id": "04ec7cbb-538e-406f-affc-715cc1e6ab63", "version": "KqlParameterItem/1.0", "name": "dest_port", "label": "Destination Port", "type": 1, "timeContext": { "durationMs": 0 }, "defaultValue": "*", "timeContextFromParameter": "time_range", "value": "*" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "threat", "comparison": "isNotEqualTo", "value": "None" }, "name": "parameters - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSyslogUTD\r\n| where (isnotempty(Classification) or (isnotempty(Malware) and Malware != \"None\"))\r\n| where '*' == '{source_router}' or Host == '{source_router}'\r\n| extend Threat = coalesce(Classification, Malware)\r\n| where Threat == '{threat}'\r\n and ('*' == '{device_ip}' or System_IP == '{device_ip}')\r\n and ('*' == '{device_name}' or Hostname == '{device_name}')\r\n and ('*' == '{action}' or Action == '{action}')\r\n and ( '*' == '{src_ip}' or SourceIP contains '{src_ip}' )\r\n and ( '*' == '{src_port}' or SourcePort contains '{src_port}' )\r\n and ('*' == '{dest_ip}' or DestinationIP contains '{dest_ip}')\r\n and ('*' == '{dest_port}' or DestinationPort contains '{dest_port}')\r\n| order by TimeGenerated desc\r\n| project\r\n [\"TimeStamp\"] = TimeGenerated,\r\n [\"Device IP\"] = System_IP,\r\n [\"Device Name\"] = Hostname,\r\n Action,\r\n [\"Source IP\"] = SourceIP,\r\n [\"Source Port\"] = SourcePort,\r\n [\"Destination IP\"] = DestinationIP,\r\n [\"Destination Port\"] = DestinationPort,\r\n SyslogMessage", "size": 0, "showAnalytics": true, "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "threat", "comparison": "isNotEqualTo", "value": "None" }, "name": "query - 3", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### Device Details for \"{device}\"" }, "conditionalVisibility": { "parameterName": "device", "comparison": "isNotEqualTo", "value": "None" }, "name": "text - 21" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "a25f2503-9ed8-4f63-a31e-1684dfcb3b0f", "version": "KqlParameterItem/1.0", "name": "threat_name", "label": "Threat", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD\r\n| where (isnotempty(Classification) or (isnotempty(Malware) and Malware != \"None\"))\r\n| where ('*' == '{source_router}' or Host == '{source_router}')\r\n| where System_IP == '{device}'\r\n| extend Threat = coalesce(Classification, Malware)\r\n| distinct Threat\r\n| order by Threat asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": "value::all" }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "fdf218c8-8484-4683-864f-a28801ea276a", "version": "KqlParameterItem/1.0", "name": "device_name", "label": "Device Name", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD\r\n| where (isnotempty(Classification) or (isnotempty(Malware) and Malware != \"None\"))\r\n and ('*' == '{source_router}' or Host == '{source_router}')\r\n and System_IP == '{device}'\r\n| distinct Hostname\r\n| order by Hostname asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": "value::all" }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "22ec09ea-f56b-44d3-acc5-b7ef5587c475", "version": "KqlParameterItem/1.0", "name": "action", "label": "Action", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD\r\n| where (isnotempty(Classification) or (isnotempty(Malware) and Malware != \"None\"))\r\n| where '*' == '{source_router}' or Host == '{source_router}'\r\n| where System_IP == '{device}'\r\n| distinct Action\r\n| order by Action", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": "value::all" }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "5dea320c-5261-4e7b-80dc-cd0931fc11cc", "version": "KqlParameterItem/1.0", "name": "src_ip", "label": "Source IP", "type": 1, "timeContext": { "durationMs": 7776000000 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "df97cf92-3031-4c6b-b562-f37e56eb25bc", "version": "KqlParameterItem/1.0", "name": "src_port", "label": "Source Port", "type": 1, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "78f708ab-1198-42ce-8f58-c096e4dd4b93", "version": "KqlParameterItem/1.0", "name": "dest_ip", "label": "Destination IP", "type": 1, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "6d1861dc-9628-486c-8fb2-0f7e0ebd6c40", "version": "KqlParameterItem/1.0", "name": "dest_port", "label": "Destination Port", "type": 1, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "value": "*" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "device", "comparison": "isNotEqualTo", "value": "None" }, "name": "parameters - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSyslogUTD\r\n| where (isnotempty(Classification) or (isnotempty(Malware) and Malware != \"None\"))\r\n| where '*' == '{source_router}' or Host == '{source_router}'\r\n| extend Threat = coalesce(Classification, Malware)\r\n| where ('*' == '{threat_name}' or Threat == '{threat_name}')\r\n and System_IP == '{device}'\r\n and ('*' == '{device_name}' or Hostname == '{device_name}')\r\n and ('*' == '{action}' or Action == '{action}')\r\n and ( '*' == '{src_ip}' or SourceIP contains '{src_ip}' )\r\n and ( '*' == '{src_port}' or SourcePort contains '{src_port}' )\r\n and ('*' == '{dest_ip}' or DestinationIP contains '{dest_ip}')\r\n and ('*' == '{dest_port}' or DestinationPort contains '{dest_port}')\r\n| order by TimeGenerated desc\r\n| project\r\n [\"TimeStamp\"] = TimeGenerated,\r\n Threat,\r\n [\"Device Name\"] = Hostname,\r\n Action,\r\n [\"Source IP\"] = SourceIP,\r\n [\"Source Port\"] = SourcePort,\r\n [\"Destination IP\"] = DestinationIP,\r\n [\"Destination Port\"] = DestinationPort,\r\n SyslogMessage", "size": 0, "showAnalytics": true, "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "customWidth": "100", "conditionalVisibility": { "parameterName": "device", "comparison": "isNotEqualTo", "value": "None" }, "name": "query - 5", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSDWANNetflow\r\n| where TimeStamp {time_range}\r\n| where ('*' == '{source_router}' or NetflowHostname == '{source_router}')\r\n and isnotempty(NetflowElement_9_2239)\r\n and isnotempty(NetflowApplicationTag)\r\n| summarize count() by NetflowApplicationTag\r\n| top 10 by count_\r\n| join kind=leftouter (CiscoSDWANNetflow\r\n | where isnotempty(NetflowApplicationName) and isnotempty(NetflowApplicationTag)\r\n | distinct NetflowApplicationName, NetflowApplicationTag)\r\n on NetflowApplicationTag\r\n| top 10 by count_\r\n| project Application = NetflowApplicationName, NetflowApplicationTag, Count = count_", "size": 0, "showAnalytics": true, "title": "Top 10 Applications", "noDataMessage": "No data was found in the selected time range.", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "NetflowApplicationTag", "parameterName": "app_tag", "defaultValue": "None" }, { "fieldName": "Application", "parameterName": "app_name", "parameterType": 1, "defaultValue": "None" } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Application", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15%" } }, { "columnMatch": "NetflowApplicationTag", "formatter": 5 }, { "columnMatch": "Count", "formatter": 4, "formatOptions": { "palette": "greenRed", "customColumnWidthSetting": "10%" } } ], "rowLimit": 10000, "filter": true }, "sortBy": [] }, "customWidth": "50", "name": "query - 19", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSDWANNetflow\r\n| where TimeStamp {time_range}\r\n| where ('*' == '{source_router}' or NetflowHostname == '{source_router}')\r\n| where isnotempty(NetflowElement_9_2239)\r\n and NetflowFwPolicy != 0\r\n and isnotempty(NetflowFwAction)\r\n| summarize count() by NetflowFwPolicy\r\n| top 10 by count_\r\n| join kind=leftouter (CiscoSDWANNetflow\r\n | where isnotempty(NetflowFwPolicyRule)\r\n and isnotempty(NetflowFwPolicy)\r\n and NetflowFwPolicy != 0\r\n | distinct NetflowFwPolicy, NetflowFwPolicyRule)\r\n on NetflowFwPolicy\r\n| top 10 by count_\r\n| project NetflowFwPolicyRule, count_", "size": 0, "showAnalytics": true, "title": "Top 10 Policy Hits", "noDataMessage": "No data was found in the selected time range.", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "policy_details", "exportDefaultValue": "None", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "NetflowFwPolicyRule", "yAxis": [ "count_" ], "group": "NetflowFwPolicyRule", "createOtherGroup": 10 } }, "customWidth": "50", "name": "query - 20", "styleSettings": { "padding": "20px", "showBorder": true } }, { "type": 1, "content": { "json": "#### Application Details for \"{app_name}\"" }, "conditionalVisibilities": [ { "parameterName": "app_name", "comparison": "isNotEqualTo", "value": "None" }, { "parameterName": "app_tag", "comparison": "isNotEqualTo", "value": "None" } ], "name": "text - 22" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "a5c14b91-9e0e-48a6-af81-a3e8595585d4", "version": "KqlParameterItem/1.0", "name": "NetflowFwSrcAddrIpv4_p", "label": "Source IP", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "*" }, { "id": "eec963a4-d364-41e8-a103-5a0dd5a804f3", "version": "KqlParameterItem/1.0", "name": "NetflowFwSrcPort_p", "label": "Source Port", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "*" }, { "id": "1f584365-0ef1-4769-b448-84d049935e8f", "version": "KqlParameterItem/1.0", "name": "NetflowFwDestAddrIpv4_p", "label": "Destination IP", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "*" }, { "id": "ea948941-aea1-4876-9fff-21d345e6c7ec", "version": "KqlParameterItem/1.0", "name": "NetflowFwDestPort_p", "label": "Destination Port", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "*" }, { "id": "69f5b4c1-c488-4061-b4bb-08f36f42506b", "version": "KqlParameterItem/1.0", "name": "NetflowInputSNMPIDX_p", "label": "Input Snmpidx", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "*" }, { "id": "3974d9e8-3560-458b-8a01-6374dfe35419", "version": "KqlParameterItem/1.0", "name": "NetflowOutputSNMPIDX_p", "label": "Output Snmpidx", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "*" }, { "id": "88ad3e98-c1d3-4b54-83d9-165afa085cd3", "version": "KqlParameterItem/1.0", "name": "NetflowUsername_p", "label": "Username", "type": 1, "value": "*" }, { "id": "0612bf6b-4dbc-4d2f-a4d9-dd52447c917e", "version": "KqlParameterItem/1.0", "name": "NetflowIngressVRFID_p", "label": "Ingress VRF ID", "type": 1, "value": "*" }, { "id": "ede46daa-ed41-418d-9858-ea587409d96a", "version": "KqlParameterItem/1.0", "name": "NetflowEgressVRFID_p", "label": "Egress VRF ID", "type": 1, "value": "*" }, { "id": "409fada2-b6d0-418b-99e7-69f8007b7d24", "version": "KqlParameterItem/1.0", "name": "NetflowFlowFieldSGT_p", "label": "Source SGT", "type": 1, "value": "*" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibilities": [ { "parameterName": "app_name", "comparison": "isNotEqualTo", "value": "None" }, { "parameterName": "app_tag", "comparison": "isNotEqualTo", "value": "None" } ], "name": "parameters - 21" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSDWANNetflow\r\n| where TimeStamp {time_range}\r\n| where ('*'=='{source_router}' or NetflowHostname=='{source_router}')\r\n and isnotempty(NetflowElement_9_2239)\r\n and NetflowApplicationTag == '{app_tag}'\r\n and ('*' == '{NetflowFwSrcAddrIpv4_p}' or tostring(NetflowFwSrcAddrIpv4) contains '{NetflowFwSrcAddrIpv4_p}')\r\n and ('*' == '{NetflowFwSrcPort_p}' or tostring(NetflowFwSrcPort) contains '{NetflowFwSrcPort_p}')\r\n and ('*' == '{NetflowFwDestAddrIpv4_p}' or tostring(NetflowFwDestAddrIpv4) contains '{NetflowFwDestAddrIpv4_p}')\r\n and ('*' == '{NetflowFwDestPort_p}' or tostring(NetflowFwDestPort) contains '{NetflowFwDestPort_p}')\r\n and ('*' == '{NetflowInputSNMPIDX_p}' or tostring(NetflowInputSNMPIDX) contains '{NetflowInputSNMPIDX_p}')\r\n and ('*' == '{NetflowOutputSNMPIDX_p}' or tostring(NetflowOutputSNMPIDX) contains '{NetflowOutputSNMPIDX_p}')\r\n and ('*' == '{NetflowUsername_p}' or tostring(NetflowUsername) contains '{NetflowUsername_p}')\r\n and ('*' == '{NetflowIngressVRFID_p}' or tostring(NetflowIngressVRFID) contains '{NetflowIngressVRFID_p}')\r\n and ('*' == '{NetflowEgressVRFID_p}' or tostring(NetflowEgressVRFID) contains '{NetflowEgressVRFID_p}')\r\n and ('*' == '{NetflowFlowFieldSGT_p}' or tostring(NetflowFlowFieldSGT) contains '{NetflowFlowFieldSGT_p}')\r\n| distinct\r\n TimeStamp,\r\n NetflowFwSrcAddrIpv4,\r\n NetflowFwSrcPort,\r\n NetflowFwDestAddrIpv4,\r\n NetflowFwDestPort,\r\n NetflowInputSNMPIDX,\r\n NetflowOutputSNMPIDX,\r\n NetflowApplicationTag,\r\n NetflowUsername,\r\n NetflowIngressVRFID,\r\n NetflowEgressVRFID,\r\n NetflowFlowFieldSGT\r\n| project\r\n TimeStamp,\r\n [\"Source IP\"]= NetflowFwSrcAddrIpv4,\r\n [\"Source Port\"]=NetflowFwSrcPort,\r\n [\"Destination IP\"]=NetflowFwDestAddrIpv4,\r\n [\"Destination Port\"]=NetflowFwDestPort,\r\n [\"Input Snmpidx\"]=NetflowInputSNMPIDX,\r\n [\"Output Snmpidx\"]=NetflowOutputSNMPIDX,\r\n [\"Username\"] = NetflowUsername,\r\n [\"Ingress VRF ID\"] = NetflowIngressVRFID,\r\n [\"Egress VRF ID\"] = NetflowEgressVRFID,\r\n [\"Source SGT\"] = NetflowFlowFieldSGT\r\n| order by TimeStamp", "size": 0, "showAnalytics": true, "noDataMessage": "No data was found in the selected time range.", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "app_tag", "comparison": "isNotEqualTo", "value": "None" }, "name": "query - 22", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### Policy Details for \"{policy_details}\"" }, "conditionalVisibility": { "parameterName": "policy_details", "comparison": "isNotEqualTo", "value": "None" }, "name": "text - 23" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "ffb686f7-2537-4535-924f-e2200dda8af7", "version": "KqlParameterItem/1.0", "name": "policy_action", "label": "Action", "type": 2, "isRequired": true, "query": "let policy_name = toscalar((CiscoSDWANNetflow\r\n | where isnotempty(NetflowFwPolicyRule) and NetflowFwPolicy != 0\r\n | distinct NetflowFwPolicy, NetflowFwPolicyRule)\r\n | where NetflowFwPolicyRule == '{policy_details}'\r\n | distinct NetflowFwPolicy);\r\nCiscoSDWANNetflow\r\n| where TimeStamp {time_range}\r\n| where ('*' == '{source_router}' or NetflowHostname == '{source_router}')\r\n| where isnotempty(NetflowElement_9_2239)\r\n and NetflowFwPolicy != 0\r\n and isnotempty(NetflowFwAction)\r\n and NetflowFwPolicy == policy_name\r\n| distinct NetflowFwAction\r\n| join (CiscoSDWANNetflow\r\n | where isnotempty(NetflowFwActionRule)\r\n | distinct NetflowFwAction, NetflowFwActionRule)\r\n on NetflowFwAction\r\n| project NetflowFwActionRule\r\n| order by NetflowFwActionRule asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": "value::all" }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "d45b6d9c-15dd-4740-ae8f-d415c932112b", "version": "KqlParameterItem/1.0", "name": "policy_src_ip", "label": "Source IP", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "*" }, { "id": "0620b5fa-6a8e-4744-8c1e-dfde992bf95c", "version": "KqlParameterItem/1.0", "name": "policy_src_port", "label": "Source Port", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "*" }, { "id": "92fc8d32-a3af-4310-a798-4b0b13a95720", "version": "KqlParameterItem/1.0", "name": "policy_dest_ip", "label": "Destination IP", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "*" }, { "id": "ecad6e3c-2c81-4262-90ee-6c2fa62ed0c7", "version": "KqlParameterItem/1.0", "name": "policy_dest_port", "label": "Destination Port", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "*" }, { "id": "99c11d5a-ed6a-43ae-a890-f7b8037eae6d", "version": "KqlParameterItem/1.0", "name": "policy_input_snmpidx", "label": "Input Snmpidx", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "*" }, { "id": "331add36-d4a0-4ac8-b65c-38c033e1ec64", "version": "KqlParameterItem/1.0", "name": "policy_output_snmpidx", "label": "Output Snmpidx", "type": 1, "timeContext": { "durationMs": 86400000 }, "value": "*" }, { "id": "74596419-b891-45b1-8552-82a7aea6e390", "version": "KqlParameterItem/1.0", "name": "policy_username", "label": "Username", "type": 1, "value": "*" }, { "id": "0b8ff954-4af9-46ba-9fdc-ee21459d545f", "version": "KqlParameterItem/1.0", "name": "policy_ingress_vrfid", "label": "Ingress VRF ID", "type": 1, "value": "*" }, { "id": "f998035e-1efd-47b5-9b57-00d84800671c", "version": "KqlParameterItem/1.0", "name": "policy_egress_vrfid", "label": "Egress VRF ID", "type": 1, "value": "*" }, { "id": "8c2965bc-5a8d-4094-ac1f-6b59458655da", "version": "KqlParameterItem/1.0", "name": "policy_source_sgt", "label": "Source SGT", "type": 1, "value": "*" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "policy_details", "comparison": "isNotEqualTo", "value": "None" }, "name": "parameters - 21 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let policy_name = toscalar((CiscoSDWANNetflow\r\n | where isnotempty(NetflowFwPolicyRule) and NetflowFwPolicy != 0\r\n | distinct NetflowFwPolicy, NetflowFwPolicyRule)\r\n | where NetflowFwPolicyRule == '{policy_details}'\r\n | project NetflowFwPolicy);\r\nCiscoSDWANNetflow\r\n| where TimeStamp\r\n{time_range}\r\n| where ('*' == '{source_router}' or NetflowHostname == '{source_router}')\r\n| where isnotempty(NetflowElement_9_2239)\r\n and NetflowFwPolicy != 0\r\n and isnotempty(NetflowFwAction)\r\n| where NetflowFwPolicy == policy_name\r\n and ('*' == '{policy_src_ip}' or tostring(NetflowFwSrcAddrIpv4) contains '{policy_src_ip}')\r\n and ('*' == '{policy_src_port}' or tostring(NetflowFwSrcPort) contains '{policy_src_port}')\r\n and ('*' == '{policy_dest_ip}' or tostring(NetflowFwDestAddrIpv4) contains '{policy_dest_ip}')\r\n and ('*' == '{policy_dest_port}' or tostring(NetflowFwDestPort) contains '{policy_dest_port}')\r\n and ('*' == '{policy_input_snmpidx}' or tostring(NetflowInputSNMPIDX) contains '{policy_input_snmpidx}')\r\n and ('*' == '{policy_output_snmpidx}' or tostring(NetflowOutputSNMPIDX) contains '{policy_output_snmpidx}')\r\n and ('*' == '{policy_username}' or tostring(NetflowUsername) contains '{policy_username}')\r\n and ('*' == '{policy_ingress_vrfid}' or tostring(NetflowIngressVRFID) contains '{policy_ingress_vrfid}')\r\n and ('*' == '{policy_egress_vrfid}' or tostring(NetflowEgressVRFID) contains '{policy_egress_vrfid}')\r\n and ('*' == '{policy_source_sgt}' or tostring(NetflowFlowFieldSGT) contains '{policy_source_sgt}')\r\n| distinct\r\n TimeStamp,\r\n NetflowFwSrcAddrIpv4,\r\n NetflowFwSrcPort,\r\n NetflowFwDestAddrIpv4,\r\n NetflowFwDestPort,\r\n NetflowInputSNMPIDX,\r\n NetflowOutputSNMPIDX,\r\n NetflowFwAction, \r\n NetflowFwPolicy,\r\n NetflowUsername,\r\n NetflowIngressVRFID,\r\n NetflowEgressVRFID,\r\n NetflowFlowFieldSGT\r\n| join kind=leftouter (CiscoSDWANNetflow\r\n | where isnotempty(NetflowFwActionRule)\r\n | distinct NetflowFwAction, NetflowFwActionRule)\r\n on NetflowFwAction\r\n| where ('*' == '{policy_action}' or tostring(NetflowFwActionRule) == '{policy_action}')\r\n| project\r\n TimeStamp,\r\n Action = NetflowFwActionRule,\r\n [\"Source IP\"]= NetflowFwSrcAddrIpv4,\r\n [\"Source Port\"]=NetflowFwSrcPort,\r\n [\"Destination IP\"]=NetflowFwDestAddrIpv4,\r\n [\"Destination Port\"]=NetflowFwDestPort,\r\n [\"Input Snmpidx\"]=NetflowInputSNMPIDX,\r\n [\"Output Snmpidx\"]=NetflowOutputSNMPIDX,\r\n [\"Username\"] = NetflowUsername,\r\n [\"Ingress VRF ID\"] = NetflowIngressVRFID,\r\n [\"Egress VRF ID\"] = NetflowEgressVRFID,\r\n [\"Source SGT\"] = NetflowFlowFieldSGT\r\n| order by TimeStamp", "size": 0, "showAnalytics": true, "noDataMessage": "No data was found in the selected time range.", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "policy_details", "comparison": "isNotEqualTo", "value": "None" }, "name": "query - 27", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSDWANNetflow\r\n| where TimeStamp {time_range} and NetflowFirewallEvent == 3 and (('*' == '{source_router}' or NetflowHostname == '{source_router}'))\r\n| summarize count() by NetflowFwSrcAddrIpv4, NetflowFwDestAddrIpv4, NetflowFwPolicy\r\n| join kind=leftouter (CiscoSDWANNetflow\r\n | where isnotempty(NetflowFwPolicyRule)\r\n and isnotempty(NetflowFwPolicy)\r\n and NetflowFwPolicy != 0\r\n | distinct NetflowFwPolicy, NetflowFwPolicyRule)\r\n on NetflowFwPolicy\r\n| project\r\n [\"Source IP\"] = NetflowFwSrcAddrIpv4,\r\n [\"Destination IP\"] = NetflowFwDestAddrIpv4,\r\n [\"Policy Rule\"] = NetflowFwPolicyRule,\r\n [\"Flow Class Name\"] = NetflowFwPolicy,\r\n Count = count_\r\n| order by Count", "size": 0, "showAnalytics": true, "title": "Dropped ZBFW Flows", "noDataMessage": "No data was found in the selected time range.", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "Source IP", "parameterName": "source_ip", "parameterType": 1, "defaultValue": "None" }, { "fieldName": "Destination IP", "parameterName": "destination_ip", "parameterType": 1, "defaultValue": "None" }, { "fieldName": "Flow Class Name", "parameterName": "fw_policy", "parameterType": 1, "defaultValue": "None" } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 4, "formatOptions": { "palette": "greenRed" } } ], "rowLimit": 10000, "filter": true } }, "name": "query - 17", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSDWANNetflow\r\n| where TimeStamp {time_range} and ( ('*' == '{source_router}' or NetflowHostname == '{source_router}'))\r\n| where NetflowFwSrcAddrIpv4 == '{source_ip}'\r\n and NetflowFwDestAddrIpv4 == '{destination_ip}'\r\n and NetflowFwPolicy == '{fw_policy}'\r\n and NetflowFirewallEvent == 3\r\n| extend TimeStamp = bin(TimeStamp, 1ms)\r\n| distinct\r\n TimeStamp,\r\n NetflowFwSrcAddrIpv4,\r\n NetflowFwDestAddrIpv4,\r\n NetflowFwSrcPort,\r\n NetflowFwDestPort,\r\n NetflowApplicationTag,\r\n NetflowUsername,\r\n NetflowIngressVRFID,\r\n NetflowEgressVRFID,\r\n NetflowFlowFieldSGT,\r\n NetflowFwPolicy\r\n| join kind=leftouter (CiscoSDWANNetflow\r\n | where isnotempty(NetflowApplicationTag)\r\n | distinct NetflowApplicationName, NetflowApplicationTag)\r\n on NetflowApplicationTag\r\n| join kind=leftouter (CiscoSDWANNetflow\r\n | where isnotempty(NetflowFwPolicyRule)\r\n and isnotempty(NetflowFwPolicy)\r\n and NetflowFwPolicy != 0\r\n | distinct NetflowFwPolicy, NetflowFwPolicyRule)\r\n on NetflowFwPolicy\r\n| project\r\n TimeStamp,\r\n [\"Source IP\"] = NetflowFwSrcAddrIpv4,\r\n [\"Destination IP\"] = NetflowFwDestAddrIpv4,\r\n [\"Source Port\"] = NetflowFwSrcPort,\r\n [\"Destination Port\"]=NetflowFwDestPort,\r\n Application = NetflowApplicationName,\r\n [\"Username\"] = NetflowUsername,\r\n [\"Ingress VRF ID\"] = NetflowIngressVRFID,\r\n [\"Egress VRF ID\"] = NetflowEgressVRFID,\r\n [\"Source SGT\"] = NetflowFlowFieldSGT,\r\n [\"Policy Rule\"] = NetflowFwPolicyRule,\r\n [\"Flow Class Name\"] = NetflowFwPolicy\r\n| order by TimeStamp", "size": 0, "showAnalytics": true, "title": "Dropped Flow Details Between \"{source_ip}\" and \"{destination_ip}\"", "noDataMessage": "No data was found in the selected time range.", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "NetflowFwPolicy", "formatter": 5 }, { "columnMatch": "NetflowFwPolicy1", "formatter": 5 } ], "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "TimeStamp", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "TimeStamp", "sortOrder": 2 } ] }, "conditionalVisibility": { "parameterName": "source_ip", "comparison": "isNotEqualTo", "value": "None" }, "name": "query - 24", "styleSettings": { "showBorder": true } } ] }, "customWidth": "50", "name": "group - 31" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSDWANNetflow\r\n| where TimeStamp {time_range} and NetflowFirewallEvent in (1, 2) and ( ('*' == '{source_router}' or NetflowHostname == '{source_router}') )\r\n| summarize count() by NetflowFwSrcAddrIpv4, NetflowFwDestAddrIpv4, NetflowFwPolicy\r\n| join kind=leftouter (CiscoSDWANNetflow\r\n | where isnotempty(NetflowFwPolicyRule)\r\n and isnotempty(NetflowFwPolicy)\r\n and NetflowFwPolicy != 0\r\n | distinct NetflowFwPolicy, NetflowFwPolicyRule)\r\n on NetflowFwPolicy\r\n| project\r\n [\"Source IP\"] = NetflowFwSrcAddrIpv4,\r\n [\"Destination IP\"] = NetflowFwDestAddrIpv4,\r\n [\"Policy Rule\"] = NetflowFwPolicyRule,\r\n [\"Flow Class Name\"] = NetflowFwPolicy,\r\n Count = count_\r\n| order by Count", "size": 0, "showAnalytics": true, "title": "Inspected ZBFW Flows", "noDataMessage": "No data was found in the selected time range.", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "Source IP", "parameterName": "source_ip2", "parameterType": 1, "defaultValue": "None" }, { "fieldName": "Destination IP", "parameterName": "destination_ip2", "parameterType": 1, "defaultValue": "None" }, { "fieldName": "Flow Class Name", "parameterName": "fw_policy2", "parameterType": 1, "defaultValue": "None" } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 4, "formatOptions": { "palette": "greenRed" } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "min": 0, "palette": "greenRed" } } ], "rowLimit": 10000, "filter": true } }, "name": "query - 18", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSDWANNetflow\r\n| where TimeStamp {time_range} and (('*' == '{source_router}' or NetflowHostname == '{source_router}'))\r\n| where NetflowFwSrcAddrIpv4 == '{source_ip2}'\r\n and NetflowFwDestAddrIpv4 == '{destination_ip2}'\r\n and NetflowFirewallEvent in (1, 2)\r\n| extend TimeStamp = bin(TimeStamp, 1ms)\r\n| distinct\r\n TimeStamp,\r\n NetflowFwSrcAddrIpv4,\r\n NetflowFwDestAddrIpv4,\r\n NetflowFwSrcPort,\r\n NetflowFwDestPort,\r\n NetflowApplicationTag,\r\n NetflowUsername,\r\n NetflowIngressVRFID,\r\n NetflowEgressVRFID,\r\n NetflowFlowFieldSGT,\r\n NetflowFwPolicy\r\n| join kind=leftouter (CiscoSDWANNetflow\r\n | where isnotempty(NetflowApplicationTag)\r\n | distinct NetflowApplicationName, NetflowApplicationTag)\r\n on NetflowApplicationTag\r\n| join kind=leftouter (CiscoSDWANNetflow\r\n | where isnotempty(NetflowFwPolicyRule)\r\n and isnotempty(NetflowFwPolicy)\r\n and NetflowFwPolicy != 0\r\n | distinct NetflowFwPolicy, NetflowFwPolicyRule)\r\n on NetflowFwPolicy\r\n| project\r\n TimeStamp,\r\n [\"Source IP\"] = NetflowFwSrcAddrIpv4,\r\n [\"Destination IP\"] = NetflowFwDestAddrIpv4,\r\n [\"Source Port\"] = NetflowFwSrcPort,\r\n [\"Destination Port\"]=NetflowFwDestPort,\r\n Application = NetflowApplicationName,\r\n [\"Username\"] = NetflowUsername,\r\n [\"Ingress VRF ID\"] = NetflowIngressVRFID,\r\n [\"Egress VRF ID\"] = NetflowEgressVRFID,\r\n [\"Source SGT\"] = NetflowFlowFieldSGT,\r\n [\"Policy Rule\"] = NetflowFwPolicyRule,\r\n [\"Flow Class Name\"] = NetflowFwPolicy\r\n| order by TimeStamp", "size": 0, "showAnalytics": true, "title": "Inspected Flow Details Between \"{source_ip2}\" and \"{destination_ip2}\"", "noDataMessage": "No data was found in the selected time range.", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "TimeStamp", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "TimeStamp", "sortOrder": 2 } ] }, "conditionalVisibilities": [ { "parameterName": "source_ip2", "comparison": "isNotEqualTo", "value": "None" }, { "parameterName": "fw_policy2", "comparison": "isNotEqualTo", "value": "None" }, { "parameterName": "destination_ip2", "comparison": "isNotEqualTo", "value": "None" } ], "name": "query - 24 - Copy", "styleSettings": { "showBorder": true } } ] }, "customWidth": "50", "name": "group - 30" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSDWANNetflow\r\n| where TimeStamp {time_range}\r\n| where ('*'=='{source_router}' or NetflowHostname=='{source_router}')\r\n| where isnotempty(NetflowUsername)\r\n| summarize arg_max(TimeStamp, NetflowFwSrcAddrIpv4) by NetflowUsername\r\n| order by NetflowUsername asc\r\n| project\r\n [\"Username\"] = NetflowUsername,\r\n [\"Source IP\"] = NetflowFwSrcAddrIpv4", "size": 0, "showAnalytics": true, "title": "Network Users", "noDataMessage": "No data was found in the selected time range.", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "Username", "parameterName": "network_username", "parameterType": 1, "defaultValue": "None" }, { "fieldName": "Source IP", "parameterName": "network_source_ip", "parameterType": 1, "defaultValue": "None" } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Username", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "10%" } }, { "columnMatch": "Source IP", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "10%" } } ], "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "Username", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "Username", "sortOrder": 1 } ] }, "name": "query - 22", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSDWANNetflow\r\n| where TimeStamp {time_range}\r\n| where ('*'=='{source_router}' or NetflowHostname=='{source_router}')\r\n| where NetflowUsername=='{network_username}' and NetflowFwSrcAddrIpv4=='{network_source_ip}'\r\n| order by TimeStamp\r\n| project-away Agent*, _ResourceId, _SubscriptionId, ECSVersion, Host*, RawData", "size": 0, "showAnalytics": true, "title": "Netflow Events (Network Users: {network_username} (Username) and {network_source_ip} (Source IP))", "noDataMessage": "No data was found in the selected time range.", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibilities": [ { "parameterName": "network_username", "comparison": "isNotEqualTo", "value": "None" }, { "parameterName": "network_source_ip", "comparison": "isNotEqualTo", "value": "None" } ], "name": "query - 23", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "πŸ“ Refresh the web page to fetch details of recently collected events." }, "name": "text - 30" } ] }, "conditionalVisibility": { "parameterName": "setTab", "comparison": "isEqualTo", "value": "SOC Overview" }, "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Threat Inspection\r\n\r\nProvide tactical guidance and insights to detect, investigate and respond to the latest threats." }, "name": "text - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "737a8536-a564-4489-afbd-a7c299a57ced", "version": "KqlParameterItem/1.0", "name": "time_range", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 86400000 } }, { "id": "cca7c133-e440-46d9-991f-48b08cf72c17", "version": "KqlParameterItem/1.0", "name": "source_router", "label": "Source Router", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD | where isnotempty(Host) | distinct Host | order by Host asc ", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": "value::all" }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 1, "content": { "json": "πŸ’‘ Click on the data points in the each of the below panels to view more details.\r\n\r\n" }, "name": "text - 39" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSyslogUTD | where ('*' == '{source_router}' or Host =='{source_router}') and isnotempty(Classification) | summarize count() by Classification", "size": 3, "showAnalytics": true, "title": "Blocked Connections Over IPS event", "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "malicious_file", "exportDefaultValue": "None", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Classification", "createOtherGroup": 10 } }, "customWidth": "50", "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSyslogUTD | where ('*' == '{source_router}' or Host =='{source_router}') and (isnotempty(Malware) and Malware!=\"None\") | summarize count() by Malware", "size": 3, "showAnalytics": true, "title": "Malicious Files by Malware", "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "malware", "exportDefaultValue": "None", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Malware", "createOtherGroup": 10 } }, "customWidth": "50", "name": "query - 3", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### Classification details for \"{malicious_file}\"" }, "conditionalVisibility": { "parameterName": "malicious_file", "comparison": "isNotEqualTo", "value": "None" }, "name": "text - 5" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "7660c654-705e-4fd4-826a-92236babaf2c", "version": "KqlParameterItem/1.0", "name": "device_ip", "label": "Device IP", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD | where '*' == '{source_router}' or Host =='{source_router}' and Classification == '{malicious_file}' | distinct System_IP | order by System_IP asc\r\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "7760355d-a483-4a19-b4de-19bf94d6d4b6", "version": "KqlParameterItem/1.0", "name": "device_name", "label": "Device Name", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD | where '*' == '{source_router}' or Host =='{source_router}' and Malware == '{malicious_file}' | distinct Hostname | order by Hostname asc ", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "c37acb94-48b9-4590-b910-ccb4941c1326", "version": "KqlParameterItem/1.0", "name": "action", "label": "Action", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD | where '*' == '{source_router}' or Host =='{source_router}' and Malware == '{malicious_file}' | distinct Action | order by Action asc ", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "7543b97f-3c7f-4d79-ac0f-8484b21184ef", "version": "KqlParameterItem/1.0", "name": "src_ip", "label": "Source IP", "type": 1, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "value": "*" }, { "version": "KqlParameterItem/1.0", "name": "username", "label": "Username", "type": 1, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "value": "*", "id": "2dd32f3a-5f9e-407e-a8ff-72f813f14b13" }, { "id": "d134d35a-2b1a-4506-8326-83d666dcda08", "version": "KqlParameterItem/1.0", "name": "src_port", "label": "Source Port", "type": 1, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "df13f5d5-3a86-479e-b292-859f56e6711b", "version": "KqlParameterItem/1.0", "name": "dest_ip", "label": "Destination IP", "type": 1, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "04ec7cbb-538e-406f-affc-715cc1e6ab63", "version": "KqlParameterItem/1.0", "name": "dest_port", "label": "Destination Port", "type": 1, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "value": "*" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "malicious_file", "comparison": "isNotEqualTo", "value": "None" }, "name": "parameters - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSyslogUTD\r\n| join kind=leftouter (MapNetflowUsername) on SourceIP\r\n| where ('*' == '{source_router}' or Host == '{source_router}')\r\n and isnotempty(Classification)\r\n and Classification == '{malicious_file}'\r\n and ('*' == '{device_ip}' or System_IP == '{device_ip}')\r\n and ('*' == '{device_name}' or Hostname == '{device_name}')\r\n and ('*' == '{action}' or Action == '{action}')\r\n and ('*' == '{src_ip}' or SourceIP contains '{src_ip}')\r\n and ('*' == '{username}' or Username contains '{username}')\r\n and ('*' == '{src_port}' or SourcePort contains '{src_port}')\r\n and ('*' == '{dest_ip}' or DestinationIP contains '{dest_ip}')\r\n and ('*' == '{dest_port}' or DestinationPort contains '{dest_port}')\r\n| summarize count()\r\n by\r\n [\"TimeStamp\"]=TimeGenerated,\r\n Classification,\r\n [\"Device IP\"]=System_IP,\r\n [\"Device Name\"]=Hostname,\r\n [\"Action\"]=Action,\r\n [\"Source IP\"] = SourceIP,\r\n [\"Username\"] = Username,\r\n [\"Source Port\"] = SourcePort,\r\n [\"Destination IP\"]=DestinationIP,\r\n [\"Destination Port\"]=DestinationPort,\r\n SyslogMessage\r\n| project-away count_, Classification\r\n| sort by TimeStamp", "size": 0, "showAnalytics": true, "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "malicious_file", "comparison": "isNotEqualTo", "value": "None" }, "name": "query - 3", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### Malware details for \"{malware}\"" }, "conditionalVisibility": { "parameterName": "malware", "comparison": "isNotEqualTo", "value": "None" }, "name": "text - 5 - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "f3e76ea5-ce9d-4e40-af70-59768e4a5a95", "version": "KqlParameterItem/1.0", "name": "device_ip", "label": "Device IP", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD | where '*' == '{source_router}' or Host =='{source_router}' and Malware == '{malware}' | distinct System_IP | order by System_IP asc \r\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "2cfb22f3-dffb-45e6-9332-82c30c9a912b", "version": "KqlParameterItem/1.0", "name": "device_name", "label": "Device Name", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD | where '*' == '{source_router}' or Host =='{source_router}' and Malware == '{malware}' | distinct Hostname | order by Hostname asc ", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "d9aedaa7-0c62-479b-a139-dab52c19f8cc", "version": "KqlParameterItem/1.0", "name": "action", "label": "Action", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD | where '*' == '{source_router}' or Host =='{source_router}' and Malware == '{malware}' | distinct Action | order by Action asc ", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "73b536df-36d4-4bc0-85fd-1c7f929f60b7", "version": "KqlParameterItem/1.0", "name": "src_ip", "label": "Source IP", "type": 1, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "value": "*" }, { "version": "KqlParameterItem/1.0", "name": "username", "label": "Username", "type": 1, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "value": "*", "id": "d193cabd-8fe0-4604-b8ce-85b5c349748c" }, { "id": "fc94f3b9-99de-4cc5-87a3-5e8eeae10a0e", "version": "KqlParameterItem/1.0", "name": "src_port", "label": "Source Port", "type": 1, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "6e0e26d3-a3fe-4356-91d3-64dc99248095", "version": "KqlParameterItem/1.0", "name": "dest_ip", "label": "Destination IP", "type": 1, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "8adf631e-66e7-42ff-b13e-ea879c28b3d6", "version": "KqlParameterItem/1.0", "name": "dest_port", "label": "Destination Port", "type": 1, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "value": "*" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "malware", "comparison": "isNotEqualTo", "value": "None" }, "name": "parameters - 2 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSyslogUTD\r\n| join kind=leftouter (MapNetflowUsername) on SourceIP\r\n| where ('*' == '{source_router}' or Host == '{source_router}')\r\n and (isnotempty(Malware) and Malware != \"None\")\r\n and Malware == '{malware}'\r\n and ('*' == '{device_ip}' or System_IP == '{device_ip}')\r\n and ('*' == '{device_name}' or Hostname == '{device_name}')\r\n and ('*' == '{action}' or Action == '{action}')\r\n and ('*' == '{src_ip}' or SourceIP contains '{src_ip}')\r\n and ('*' == '{username}' or Username contains '{username}')\r\n and ('*' == '{src_port}' or SourcePort contains '{src_port}')\r\n and ('*' == '{dest_ip}' or DestinationIP contains '{dest_ip}')\r\n and ('*' == '{dest_port}' or DestinationPort contains '{dest_port}')\r\n| summarize count()\r\n by\r\n [\"TimeStamp\"]=TimeGenerated,\r\n Malware,\r\n [\"Device IP\"]=System_IP,\r\n [\"Device Name\"]=Hostname,\r\n [\"Action\"]=Action,\r\n [\"Source IP\"] = SourceIP,\r\n [\"Username\"] = Username,\r\n [\"Source Port\"] = SourcePort,\r\n [\"Destination IP\"]=DestinationIP,\r\n [\"Destination Port\"]=DestinationPort,\r\n SyslogMessage\r\n| project-away count_, Malware\r\n| sort by TimeStamp", "size": 0, "showAnalytics": true, "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "malware", "comparison": "isNotEqualTo", "value": "None" }, "name": "query - 3 - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSyslogUTD | where ('*' == '{source_router}' or Host =='{source_router}') and Malware!=\"None\" and isnotempty(Filetype) | summarize count() by Filetype", "size": 3, "showAnalytics": true, "title": "Malicious Files by Type", "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "file_type", "exportDefaultValue": "None", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Filetype", "createOtherGroup": 10 } }, "customWidth": "50", "name": "query - 3 - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSyslogUTD | where ('*' == '{source_router}' or Host =='{source_router}') and isnotempty(FileInspectionLogs) | summarize count() by FileInspectionLogs", "size": 3, "showAnalytics": true, "title": "File Scan Results by Disposition", "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "disposition", "exportDefaultValue": "None", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "FileInspectionLogs", "createOtherGroup": 10 } }, "customWidth": "50", "name": "query - 3 - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### Filetype details for \"{file_type}\"" }, "conditionalVisibility": { "parameterName": "file_type", "comparison": "isNotEqualTo", "value": "None" }, "name": "text - 5 - Copy - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "9057f621-352d-472f-86f3-e554315cd704", "version": "KqlParameterItem/1.0", "name": "device_ip", "label": "Device IP", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD | where '*' == '{source_router}' or Host =='{source_router}' and Filetype == '{file_type}' | distinct System_IP | order by System_IP asc \r\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "17c9d41d-72d2-4f6e-aa29-6c4d5190927e", "version": "KqlParameterItem/1.0", "name": "device_name", "label": "Device Name", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD | where '*' == '{source_router}' or Host =='{source_router}' and Filetype == '{file_type}' | distinct Hostname | order by Hostname asc ", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "595ca5f5-022e-4553-b06f-9591d81c8e05", "version": "KqlParameterItem/1.0", "name": "action", "label": "Action", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD | where '*' == '{source_router}' or Host =='{source_router}' and Filetype == '{file_type}' | distinct Action | order by Action asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "11514103-b05f-4de1-bc05-ba007b253aa6", "version": "KqlParameterItem/1.0", "name": "src_ip", "label": "Source IP", "type": 1, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "73b536df-36d4-4bc0-85fd-1c7f929f60b7", "version": "KqlParameterItem/1.0", "name": "username", "label": "Username", "type": 1, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "891b25ac-1227-407f-a5ed-3a9ab2868e97", "version": "KqlParameterItem/1.0", "name": "src_port", "label": "Source Port", "type": 1, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "ebec113c-c650-47de-8414-f8fa4321a57b", "version": "KqlParameterItem/1.0", "name": "dest_ip", "label": "Destination IP", "type": 1, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "58f0eaa7-c41d-4842-924a-060ac2a3a37e", "version": "KqlParameterItem/1.0", "name": "dest_port", "label": "Destination Port", "type": 1, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "value": "*" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "file_type", "comparison": "isNotEqualTo", "value": "None" }, "name": "parameters - 2 - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSyslogUTD\r\n| join kind=leftouter (MapNetflowUsername) on SourceIP\r\n| where ('*' == '{source_router}' or Host == '{source_router}')\r\n and Malware != \"None\"\r\n and isnotempty(Filetype)\r\n and Filetype == '{file_type}'\r\n and ('*' == '{device_ip}' or System_IP == '{device_ip}')\r\n and ('*' == '{device_name}' or Hostname == '{device_name}')\r\n and ('*' == '{action}' or Action == '{action}')\r\n and ('*' == '{src_ip}' or SourceIP contains '{src_ip}')\r\n and ('*' == '{username}' or Username contains '{username}')\r\n and ('*' == '{src_port}' or SourcePort contains '{src_port}')\r\n and ('*' == '{dest_ip}' or DestinationIP contains '{dest_ip}')\r\n and ('*' == '{dest_port}' or DestinationPort contains '{dest_port}')\r\n| summarize count()\r\n by\r\n [\"TimeStamp\"]=TimeGenerated,\r\n Filetype,\r\n [\"Device IP\"]=System_IP,\r\n [\"Device Name\"]=Hostname,\r\n [\"Action\"]=Action,\r\n [\"Source IP\"] = SourceIP,\r\n [\"Username\"] = Username,\r\n [\"Source Port\"] = SourcePort,\r\n [\"Destination IP\"]=DestinationIP,\r\n [\"Destination Port\"]=DestinationPort,\r\n SyslogMessage\r\n| project-away count_, Filetype\r\n| sort by TimeStamp", "size": 0, "showAnalytics": true, "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "file_type", "comparison": "isNotEqualTo", "value": "None" }, "name": "query - 3 - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### UTD Amp Disposition details for \"{disposition}\"" }, "conditionalVisibility": { "parameterName": "disposition", "comparison": "isNotEqualTo", "value": "None" }, "name": "text - 5 - Copy - Copy - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "f9db287c-d5e5-4884-8073-0bf92effb28b", "version": "KqlParameterItem/1.0", "name": "device_ip", "label": "Device IP", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD | where '*' == '{source_router}' or Host =='{source_router}' and FileInspectionLogs == '{disposition}' | distinct System_IP | order by System_IP asc \r\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "66524b51-4ac6-461e-bc00-a8bcd3a0573a", "version": "KqlParameterItem/1.0", "name": "device_name", "label": "Device Name", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD | where '*' == '{source_router}' or Host =='{source_router}' and FileInspectionLogs == '{disposition}' | distinct Hostname | order by Hostname asc ", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "ecb113b5-fc7e-4cc9-85db-12f43db01d88", "version": "KqlParameterItem/1.0", "name": "action", "label": "Action", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD | where '*' == '{source_router}' or Host =='{source_router}' and FileInspectionLogs == '{disposition}' | distinct Action | order by Action asc ", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "4be369b6-0da3-4284-91af-5cdfe2f3ebfa", "version": "KqlParameterItem/1.0", "name": "src_ip", "label": "Source IP", "type": 1, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "73b536df-36d4-4bc0-85fd-1c7f929f60b7", "version": "KqlParameterItem/1.0", "name": "username", "label": "Username", "type": 1, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "0551b3e7-3746-4e6a-a98b-e60f22c811f6", "version": "KqlParameterItem/1.0", "name": "src_port", "label": "Source Port", "type": 1, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "2afadb3f-51d1-4f6f-8ace-ee04c5f5d153", "version": "KqlParameterItem/1.0", "name": "dest_ip", "label": "Destination IP", "type": 1, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "84d38235-1b15-4867-979f-1ddf1565f1fc", "version": "KqlParameterItem/1.0", "name": "dest_port", "label": "Destination Port", "type": 1, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "value": "*" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "disposition", "comparison": "isNotEqualTo", "value": "None" }, "name": "parameters - 2 - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSyslogUTD\r\n| join kind=leftouter (MapNetflowUsername) on SourceIP\r\n| where ('*' == '{source_router}' or Host == '{source_router}')\r\n and isnotempty(FileInspectionLogs)\r\n and FileInspectionLogs == '{disposition}'\r\n and ('*' == '{device_ip}' or System_IP == '{device_ip}')\r\n and ('*' == '{device_name}' or Hostname == '{device_name}')\r\n and ('*' == '{action}' or Action == '{action}')\r\n and ('*' == '{src_ip}' or SourceIP contains '{src_ip}')\r\n and ('*' == '{username}' or Username contains '{username}')\r\n and ('*' == '{src_port}' or SourcePort contains '{src_port}')\r\n and ('*' == '{dest_ip}' or DestinationIP contains '{dest_ip}')\r\n and ('*' == '{dest_port}' or DestinationPort contains '{dest_port}')\r\n| summarize count()\r\n by\r\n [\"TimeStamp\"]=TimeGenerated,\r\n FileInspectionLogs,\r\n [\"Device IP\"]=System_IP,\r\n [\"Device Name\"]=Hostname,\r\n [\"Action\"]=Action,\r\n [\"Source IP\"] = SourceIP,\r\n [\"Username\"] = Username,\r\n [\"Source Port\"] = SourcePort,\r\n [\"Destination IP\"]=DestinationIP,\r\n [\"Destination Port\"]=DestinationPort,\r\n SyslogMessage\r\n| project-away count_, FileInspectionLogs\r\n| sort by TimeStamp", "size": 0, "showAnalytics": true, "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "disposition", "comparison": "isNotEqualTo", "value": "None" }, "name": "query - 3 - Copy - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSyslogUTD | where ('*' == '{source_router}' or Host =='{source_router}') and Malware !=\"None\" and (isnotempty(FileInspectionLogs) and isnotempty(Filetype) and isnotempty(Malware) and isnotempty(Filename)) | summarize count() by Filename, Filetype, Malware, FileInspectionLogs | sort by count_", "size": 0, "showAnalytics": true, "title": "Malicious Files", "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "Filename", "parameterName": "filename", "parameterType": 1, "defaultValue": "None" }, { "fieldName": "Filetype", "parameterName": "filetype", "parameterType": 1, "defaultValue": "None" }, { "fieldName": "Malware", "parameterName": "malware", "parameterType": 1, "defaultValue": "None" }, { "fieldName": "FileInspectionLogs", "parameterName": "fileinspectionlogs", "parameterType": 1, "defaultValue": "None" } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 4, "formatOptions": { "min": 0, "palette": "greenRed" } } ], "rowLimit": 10000, "filter": true, "labelSettings": [ { "columnId": "FileInspectionLogs", "label": "UTD Amp Disposition" }, { "columnId": "count_", "label": "Count" } ] } }, "name": "query - 18", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSyslogUTD\r\n| where ('*' == '{source_router}' or Host == '{source_router}')\r\n and Malware == '{malware}'\r\n and Filetype == '{filetype}'\r\n and Filename == '{filename}'\r\n and FileInspectionLogs == '{fileinspectionlogs}'\r\n| join kind=leftouter (MapNetflowUsername) on SourceIP\r\n| project-away SourceIP1\r\n| sort by TimeGenerated", "size": 0, "showAnalytics": true, "title": "Syslog Events (Malicious File: {filename} (File Name), {filetype} (File Type), {malware} (Malware), {fileinspectionlogs} (UTD Amp Disposition) )", "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true, "labelSettings": [ { "columnId": "FileInspectionLogs", "label": "UTD Amp Disposition" } ] } }, "conditionalVisibility": { "parameterName": "filename", "comparison": "isNotEqualTo", "value": "None" }, "name": "query - 18 - Copy", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "" }, "customWidth": "50", "name": "text - 36" }, { "type": 1, "content": { "json": "#### Blocked Connections Over URL" }, "customWidth": "50", "name": "text - 42" }, { "type": 1, "content": { "json": "" }, "customWidth": "50", "name": "text - 36" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "0af8dc1a-4e2d-484c-bac6-a6c9e26c5270", "version": "KqlParameterItem/1.0", "name": "filter_url", "label": "URLs", "type": 2, "multiSelect": true, "isRequired": true, "quote": "'", "delimiter": ",", "query": "CiscoSyslogUTD | where UTDWebfilter==\"Blacklist\" and ('*' == '{source_router}' or Host == '{source_router}')| distinct URL | order by URL asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "parameters - 35" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSyslogUTD | where UTDWebfilter==\"Category/Reputation\" and ('*' == '{source_router}' or Host == '{source_router}') | summarize count() by Category", "size": 3, "showAnalytics": true, "title": "Blocked Connections Over Category", "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "category", "exportDefaultValue": "None", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Category", "createOtherGroup": 10 } }, "customWidth": "50", "name": "query - 20 - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSyslogUTD | where UTDWebfilter==\"Blacklist\" and ('*' == '{source_router}' or Host == '{source_router}') and ('*' in ({filter_url}) or URL in ({filter_url})) | summarize count() by URL", "size": 3, "showAnalytics": true, "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "url", "exportDefaultValue": "None", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "URL", "createOtherGroup": 10 } }, "customWidth": "50", "name": "Blocked Connections Over URL", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSyslogUTD | where UTDWebfilter==\"Category/Reputation\" and ('*' == '{source_router}' or Host == '{source_router}') and Category=='{category}' | summarize count() by URL,Reputation \r\n| extend Reputation = case(toint(Reputation)>80, \"Trustworthy\", \r\n toint(Reputation)>60, \"Low Risk\", \r\n toint(Reputation)>40, \"Moderate Risk\", \r\n toint(Reputation)>20, \"Suspicious\", \r\n toint(Reputation)>=0, \"High Risk\", \"Invalid Reputation\") | sort by Reputation asc, count_ desc", "size": 0, "showAnalytics": true, "title": "Url Details for Category: \"{category}\"", "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "exportFieldName": "URL", "exportParameterName": "url_details", "exportDefaultValue": "None", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Reputation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Trustworthy", "representation": "greenDark", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low Risk", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Moderate Risk", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Suspicious", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High Risk", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "min": 0, "palette": "greenRed" } } ], "rowLimit": 10000, "filter": true, "labelSettings": [ { "columnId": "count_", "label": "Count" } ] }, "chartSettings": { "showMetrics": false, "showLegend": true } }, "conditionalVisibility": { "parameterName": "category", "comparison": "isNotEqualTo", "value": "None" }, "name": "query - 20 - Copy - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### URL Details for \"{url_details}\"" }, "conditionalVisibilities": [ { "parameterName": "url_details", "comparison": "isNotEqualTo", "value": "None" }, { "parameterName": "category", "comparison": "isNotEqualTo", "value": "None" } ], "name": "text - 22 - Copy - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "774960fd-0da7-4fb2-9f06-659822d898dd", "version": "KqlParameterItem/1.0", "name": "device_ip", "label": "Device IP", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD | where ('*' == '{source_router}' or Host =='{source_router}') and URL=='{url_details}' | distinct System_IP | order by System_IP asc \r\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "918d7c04-d94c-4292-9e48-1fabe04b6400", "version": "KqlParameterItem/1.0", "name": "device_name", "label": "Device Name", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD | where ('*' == '{source_router}' or Host =='{source_router}') and URL=='{url_details}' | distinct Hostname | order by Hostname asc ", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "288e9214-6e80-4853-aa63-3a9ce76a0a39", "version": "KqlParameterItem/1.0", "name": "action", "label": "Action", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD | where ('*' == '{source_router}' or Host =='{source_router}') and URL=='{url_details}' | distinct Action | order by Action asc ", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "6abbf82f-ae0d-4ede-8693-67dc9671d702", "version": "KqlParameterItem/1.0", "name": "src_ip", "label": "Source IP", "type": 1, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "73b536df-36d4-4bc0-85fd-1c7f929f60b7", "version": "KqlParameterItem/1.0", "name": "username", "label": "Username", "type": 1, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "b5b59219-cdf2-4da6-99e4-3ef12b91e20e", "version": "KqlParameterItem/1.0", "name": "src_port", "label": "Source Port", "type": 1, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "f40c288c-490c-4bf2-a237-5bcf6425c00d", "version": "KqlParameterItem/1.0", "name": "dest_ip", "label": "Destination IP", "type": 1, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "2869236b-9f76-43db-846c-2d20208158c9", "version": "KqlParameterItem/1.0", "name": "dest_port", "label": "Destination Port", "type": 1, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "value": "*" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibilities": [ { "parameterName": "url_details", "comparison": "isNotEqualTo", "value": "None" }, { "parameterName": "category", "comparison": "isNotEqualTo", "value": "None" } ], "name": "parameters - 2 - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSyslogUTD\r\n| join kind=leftouter (MapNetflowUsername) on SourceIP\r\n| where ('*' == '{source_router}' or Host == '{source_router}')\r\n and URL == '{url_details}'\r\n and ('*' == '{device_ip}' or System_IP == '{device_ip}')\r\n and ('*' == '{device_name}' or Hostname == '{device_name}')\r\n and ('*' == '{action}' or Action == '{action}')\r\n and ('*' == '{src_ip}' or SourceIP contains '{src_ip}')\r\n and ('*' == '{username}' or Username contains '{username}')\r\n and ('*' == '{src_port}' or SourcePort contains '{src_port}')\r\n and ('*' == '{dest_ip}' or DestinationIP contains '{dest_ip}')\r\n and ('*' == '{dest_port}' or DestinationPort contains '{dest_port}')\r\n| summarize count()\r\n by\r\n [\"TimeStamp\"]=TimeGenerated,\r\n URL,\r\n [\"Device IP\"]=System_IP,\r\n [\"Device Name\"]=Hostname,\r\n [\"Action\"]=Action,\r\n [\"Source IP\"] = SourceIP,\r\n [\"Username\"] = Username,\r\n [\"Source Port\"] = SourcePort,\r\n [\"Destination IP\"]=DestinationIP,\r\n [\"Destination Port\"]=DestinationPort,\r\n SyslogMessage\r\n| project-away count_, URL\r\n| sort by TimeStamp", "size": 0, "showAnalytics": true, "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true }, "sortBy": [] }, "conditionalVisibilities": [ { "parameterName": "url_details", "comparison": "isNotEqualTo", "value": "None" }, { "parameterName": "category", "comparison": "isNotEqualTo", "value": "None" } ], "name": "query - 3 - Copy - Copy - Copy - Copy - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### URL Details for \"{url}\"" }, "conditionalVisibility": { "parameterName": "url", "comparison": "isNotEqualTo", "value": "None" }, "name": "text - 22 - Copy" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "0f9d61a8-c945-46bf-be43-c5c67de7fa8d", "version": "KqlParameterItem/1.0", "name": "device_ip", "label": "Device IP", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD | where ('*' == '{source_router}' or Host =='{source_router}') and UTDWebfilter =='Blacklist' and URL=='{url}' | distinct System_IP | order by System_IP asc \r\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "ff654403-9675-4d92-b927-8cf4895ed0a1", "version": "KqlParameterItem/1.0", "name": "device_name", "label": "Device Name", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD | where ('*' == '{source_router}' or Host =='{source_router}') and UTDWebfilter =='Blacklist' and URL=='{url}' | distinct Hostname | order by Hostname asc ", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "7f85fb1e-737b-4086-a2ca-0f1bda79e76d", "version": "KqlParameterItem/1.0", "name": "action", "label": "Action", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD | where ('*' == '{source_router}' or Host =='{source_router}') and UTDWebfilter =='Blacklist' and URL=='{url}' | distinct Action | order by Action asc ", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "005efe9b-2ef2-46ac-b031-5910e7a05f31", "version": "KqlParameterItem/1.0", "name": "src_ip", "label": "Source IP", "type": 1, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "73b536df-36d4-4bc0-85fd-1c7f929f60b7", "version": "KqlParameterItem/1.0", "name": "username", "label": "Username", "type": 1, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "13f22a3c-472b-41be-9806-452b0192129c", "version": "KqlParameterItem/1.0", "name": "src_port", "label": "Source Port", "type": 1, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "d6c2ca9a-ee3e-4adf-9820-e3144deba9e9", "version": "KqlParameterItem/1.0", "name": "dest_ip", "label": "Destination IP", "type": 1, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "f7ba2479-77a2-425b-b1f3-2aeccf6545d4", "version": "KqlParameterItem/1.0", "name": "dest_port", "label": "Destination Port", "type": 1, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "value": "*" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "url", "comparison": "isNotEqualTo", "value": "None" }, "name": "parameters - 2 - Copy - Copy - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSyslogUTD\r\n| join kind=leftouter (MapNetflowUsername) on SourceIP\r\n| where ('*' == '{source_router}' or Host == '{source_router}')\r\n and UTDWebfilter == \"Blacklist\"\r\n and URL == '{url}'\r\n and ('*' == '{device_ip}' or System_IP == '{device_ip}')\r\n and ('*' == '{device_name}' or Hostname == '{device_name}')\r\n and ('*' == '{action}' or Action == '{action}')\r\n and ('*' == '{src_ip}' or SourceIP contains '{src_ip}')\r\n and ('*' == '{username}' or Username contains '{username}')\r\n and ('*' == '{src_port}' or SourcePort contains '{src_port}')\r\n and ('*' == '{dest_ip}' or DestinationIP contains '{dest_ip}')\r\n and ('*' == '{dest_port}' or DestinationPort contains '{dest_port}')\r\n| summarize count()\r\n by\r\n [\"TimeStamp\"]=TimeGenerated,\r\n URL,\r\n [\"Device IP\"]=System_IP,\r\n [\"Device Name\"]=Hostname,\r\n [\"Action\"]=Action,\r\n [\"Source IP\"] = SourceIP,\r\n [\"Username\"] = Username,\r\n [\"Source Port\"] = SourcePort,\r\n [\"Destination IP\"]=DestinationIP,\r\n [\"Destination Port\"]=DestinationPort,\r\n SyslogMessage\r\n| project-away count_, URL\r\n| sort by TimeStamp", "size": 0, "showAnalytics": true, "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "url", "comparison": "isNotEqualTo", "value": "None" }, "name": "query - 3 - Copy - Copy - Copy - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### Blocked Connections Over Source" }, "customWidth": "50", "name": "text - 41" }, { "type": 1, "content": { "json": "#### URL Reputation" }, "customWidth": "50", "name": "text - 40" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "6c263e37-5f29-4f77-b8aa-a9db63ff51d9", "version": "KqlParameterItem/1.0", "name": "filter_url_source", "label": "Source IPs", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "CiscoSyslogUTD | where UTDWebfilter contains \"Blacklist\" and ('*' == '{source_router}' or Host == '{source_router}') and isnotempty(SourceIP) | distinct SourceIP | order by SourceIP asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "parameters - 38" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "1d84e6fb-eb45-4b3c-93aa-1d9aac1604c6", "version": "KqlParameterItem/1.0", "name": "filter_url_reputation", "label": "URLs", "type": 2, "multiSelect": true, "quote": "'", "isRequired": true, "delimiter": ",", "query": "CiscoSyslogUTD | where ('*' == '{source_router}' or Host == '{source_router}') and UTDWebfilter==\"Category/Reputation\" and isnotempty(URL)| distinct URL | order by URL asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "parameters - 35 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSyslogUTD | where UTDWebfilter contains \"Blacklist\" and ('*' == '{source_router}' or Host == '{source_router}') and ('*' in ({filter_url_source}) or SourceIP in ({filter_url_source})) | summarize count() by SourceIP", "size": 3, "showAnalytics": true, "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "source_ip", "exportDefaultValue": "None", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "SourceIP", "createOtherGroup": 10, "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "50", "name": "Blocked Connections Over Source", "styleSettings": { "padding": "70px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSyslogUTD | where UTDWebfilter==\"Category/Reputation\" and ('*' == '{source_router}' or Host == '{source_router}') and ('*' in ({filter_url_reputation}) or URL in ({filter_url_reputation})) | summarize count() by URL,Reputation \r\n| extend Reputation = case(toint(Reputation)>80, \"Trustworthy\", \r\n toint(Reputation)>60, \"Low Risk\", \r\n toint(Reputation)>40, \"Moderate Risk\", \r\n toint(Reputation)>20, \"Suspicious\", \r\n toint(Reputation)>=0, \"High Risk\", \"Invalid Reputation\") | sort by Reputation asc, count_ desc \r\n", "size": 0, "showAnalytics": true, "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "exportFieldName": "URL", "exportParameterName": "url_reputation", "exportDefaultValue": "None", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Reputation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Trustworthy", "representation": "greenDark", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low Risk", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Moderate Risk", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Suspicious", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High Risk", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "min": 0, "palette": "greenRed" } } ], "rowLimit": 10000, "filter": true, "labelSettings": [ { "columnId": "count_", "label": "Count" } ] } }, "customWidth": "50", "name": "query - 33", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### Source IP Details for \"{source_ip}\"" }, "conditionalVisibility": { "parameterName": "source_ip", "comparison": "isNotEqualTo", "value": "None" }, "name": "text - 22" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "46234550-0061-4378-81ff-a9dea7eb977d", "version": "KqlParameterItem/1.0", "name": "device_ip", "label": "Device IP", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD | where ('*' == '{source_router}' or Host =='{source_router}') and UTDWebfilter =='Blacklist' and SourceIP=='{source_ip}' | distinct System_IP | order by System_IP asc \r\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "c1fd5338-e958-49c2-8f35-8b127dd8efc4", "version": "KqlParameterItem/1.0", "name": "device_name", "label": "Device Name", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD | where ('*' == '{source_router}' or Host =='{source_router}') and UTDWebfilter =='Blacklist' and SourceIP=='{source_ip}' | distinct Hostname | order by Hostname asc ", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "e4d208b9-5767-47fd-a220-f07228828859", "version": "KqlParameterItem/1.0", "name": "action", "label": "Action", "type": 2, "isRequired": true, "query": "CiscoSyslogUTD | where ('*' == '{source_router}' or Host =='{source_router}') and UTDWebfilter =='Blacklist' and SourceIP=='{source_ip}' | distinct Action | order by Action asc ", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "73b536df-36d4-4bc0-85fd-1c7f929f60b7", "version": "KqlParameterItem/1.0", "name": "username", "label": "Username", "type": 1, "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "c7fb714c-667b-45a1-9676-eaf18b8a348a", "version": "KqlParameterItem/1.0", "name": "src_port", "label": "Source Port", "type": 1, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "bd0e29cf-220f-45d8-956c-338dfe49b301", "version": "KqlParameterItem/1.0", "name": "dest_ip", "label": "Destination IP", "type": 1, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "value": "*" }, { "id": "bb05d23d-fd3c-49fb-bf34-9329df458c75", "version": "KqlParameterItem/1.0", "name": "dest_port", "label": "Destination Port", "type": 1, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "value": "*" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "source_ip", "comparison": "isNotEqualTo", "value": "None" }, "name": "parameters - 2 - Copy - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSyslogUTD\r\n| join kind=leftouter (MapNetflowUsername) on SourceIP\r\n| where ('*' == '{source_router}' or Host == '{source_router}')\r\n and UTDWebfilter == 'Blacklist'\r\n and SourceIP == '{source_ip}'\r\n and ('*' == '{device_ip}' or System_IP == '{device_ip}')\r\n and ('*' == '{device_name}' or Hostname == '{device_name}')\r\n and ('*' == '{action}' or Action == '{action}')\r\n and ('*' == '{src_ip}' or SourceIP contains '{src_ip}')\r\n and ('*' == '{username}' or Username contains '{username}')\r\n and ('*' == '{src_port}' or SourcePort contains '{src_port}')\r\n and ('*' == '{dest_ip}' or DestinationIP contains '{dest_ip}')\r\n and ('*' == '{dest_port}' or DestinationPort contains '{dest_port}')\r\n| summarize count()\r\n by\r\n [\"TimeStamp\"]=TimeGenerated,\r\n [\"Device IP\"]=System_IP,\r\n [\"Device Name\"]=Hostname,\r\n [\"Action\"]=Action,\r\n SourceIP,\r\n [\"Username\"]=Username,\r\n [\"Source Port\"]=SourcePort,\r\n [\"Destination IP\"]=DestinationIP,\r\n [\"Destination Port\"]=DestinationPort,\r\n SyslogMessage\r\n| project-away count_, SourceIP\r\n| sort by TimeStamp", "size": 0, "showAnalytics": true, "noDataMessage": "No data was found in selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "source_ip", "comparison": "isNotEqualTo", "value": "None" }, "name": "query - 3 - Copy - Copy - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSyslogUTD \r\n| where UTDWebfilter==\"Category/Reputation\" and ('*' == '{source_router}' or Host == '{source_router}') and URL==\"{url_reputation}\" \r\n| join kind=leftouter (MapNetflowUsername) on SourceIP \r\n| project-away SourceIP1 \r\n| sort by TimeGenerated", "size": 0, "showAnalytics": true, "title": "Syslog Events (URL Reputation: {url_reputation} (URL))", "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "url_reputation", "comparison": "isNotEqualTo", "value": "None" }, "name": "query - 33 - Copy", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "πŸ“ Refresh the web page to fetch details of recently collected events." }, "name": "text - 39" } ] }, "conditionalVisibility": { "parameterName": "setTab", "comparison": "isEqualTo", "value": "Threat Inspection" }, "name": "group - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Flow Analysis\r\n\r\nThe dashboard provides information related to \"Netflow\" data such as top network talkers and top source and destination countries." }, "name": "text - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "43bb623f-9355-4d9f-a770-ca24a9332998", "version": "KqlParameterItem/1.0", "name": "time_range", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 86400000 } }, { "id": "ee84313f-a519-478d-bc9b-2cf19d079792", "version": "KqlParameterItem/1.0", "name": "source_router", "label": "Source Router", "type": 2, "isRequired": true, "query": "let HostName = CiscoSDWANNetflow | where isnotempty(NetflowHostname) | distinct NetflowHostname | project Host=NetflowHostname;\nCiscoSyslogFW6LogSummary | where isnotempty(Host) | union HostName | distinct Host | order by Host asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": "value::all" }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 1, "content": { "json": "πŸ’‘ Click on the data points in the each of the below panels to view more details.\r\n\r\n" }, "name": "text - 39" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSDWANNetflow\r\n| where ('*'=='{source_router}' or NetflowHostname=='{source_router}')\r\n| where isnotempty(NetflowElement_9_2239) and isnotempty(NetflowPacketsIn)\r\n| summarize total_packets = sum(toint(NetflowPacketsIn)) by Type\r\n| extend title = \"Netflow Packets\", subtitle = \" \"", "size": 3, "showAnalytics": true, "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "exportFieldName": "total_packets", "exportParameterName": "netflow_packets", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "title", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } }, "subtitleContent": { "columnMatch": "subtitle", "formatter": 1 }, "leftContent": { "columnMatch": "total_packets", "formatter": 12, "formatOptions": { "palette": "none" } }, "showBorder": false, "size": "full" } }, "name": "query - 2", "styleSettings": { "padding": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSDWANNetflow\r\n| where ('*'=='{source_router}' or NetflowHostname=='{source_router}')\r\n| where isnotempty(NetflowElement_9_2239) and isnotempty(NetflowPacketsIn) | sort by TimeStamp | project-away Agent*, _ResourceId, _SubscriptionId, ECSVersion, Host*, RawData", "size": 0, "showAnalytics": true, "title": "Netflow Events for Netflow Packets", "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "netflow_packets", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 3", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### NetFlow Packets Timeline" }, "name": "text - 19" }, { "type": 1, "content": { "json": "πŸ’‘ This chart displays the latest 10000 events over time." }, "name": "text - 20" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSDWANNetflow\r\n| where ('*'=='{source_router}' or NetflowHostname=='{source_router}')\r\n| where isnotempty(NetflowElement_9_2239) and isnotempty(NetflowPacketsIn)\r\n| sort by TimeStamp | limit 10000\r\n| summarize total_packets = sum(toint(NetflowPacketsIn)) by EventVendor, TimeStamp", "size": 0, "showAnalytics": true, "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "x", "parameterName": "TimeGeneratedTimeChart", "parameterType": 1, "defaultValue": "none" }, { "fieldName": "series", "parameterName": "TypeTimeChart", "parameterType": 1, "defaultValue": "none" } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "gridSettings": { "rowLimit": 10000 }, "chartSettings": { "xAxis": "TimeStamp", "yAxis": [ "total_packets" ], "seriesLabelSettings": [ { "seriesName": "CiscoSD-WAN", "label": "Packets" } ] } }, "name": "query - 4", "styleSettings": { "padding": "10px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let converted_time_packets = todatetime(extract(@\"\\w{3}\\s\\d{1,2}\\s\\d{4}\\s\\d{1,2}:\\d{1,2}:\\d{1,2}\\sGMT\\S{5}\", 0,'{TimeGeneratedTimeChart}'));\r\nCiscoSDWANNetflow\r\n| where ('*'=='{source_router}' or NetflowHostname=='{source_router}')\r\n| where isnotempty(NetflowElement_9_2239) and isnotempty(NetflowPacketsIn)\r\n| where EventVendor=='{TypeTimeChart}' and bin(TimeStamp,1s) == converted_time_packets | sort by TimeStamp | project-away Agent*, _ResourceId, _SubscriptionId, ECSVersion, Host*, RawData", "size": 0, "showAnalytics": true, "title": "Netflow Events (NetFlow Packets Timeline: {TimeGeneratedTimeChart} (Time Generated))", "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibilities": [ { "parameterName": "TimeGeneratedTimeChart", "comparison": "isNotEqualTo", "value": "none" }, { "parameterName": "TypeTimeChart", "comparison": "isNotEqualTo", "value": "none" } ], "name": "query - 5", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let IP_Data = external_data(network:string,geoname_id:long,continent_code:string,continent_name:string ,country_iso_code:string,country_name:string,is_anonymous_proxy:bool,is_satellite_provider:bool)\r\n ['https://raw.githubusercontent.com/datasets/geoip2-ipv4/master/data/geoip2-ipv4.csv']\r\n with (ignoreFirstRecord=true, format=\"csv\");\r\nCiscoSDWANNetflow\r\n| where ('*'=='{source_router}' or NetflowHostname=='{source_router}')\r\n| where isnotempty(NetflowElement_9_2239) and isnotempty(NetflowFwSrcAddrIpv4)\r\n| evaluate ipv4_lookup(IP_Data, NetflowFwSrcAddrIpv4, network)\r\n| summarize count() by network, country_name", "size": 0, "showAnalytics": true, "title": "Top Source Countries", "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "map", "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "country_name", "latitude": "src_ip_s", "longitude": "src_ip_s", "sizeSettings": "count_", "sizeAggregation": "Sum", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "count_", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "name": "query - 6", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let IP_Data = external_data(network:string,geoname_id:long,continent_code:string,continent_name:string ,country_iso_code:string,country_name:string,is_anonymous_proxy:bool,is_satellite_provider:bool)\r\n ['https://raw.githubusercontent.com/datasets/geoip2-ipv4/master/data/geoip2-ipv4.csv']\r\n with (ignoreFirstRecord=true, format=\"csv\");\r\nCiscoSDWANNetflow\r\n| where ('*'=='{source_router}' or NetflowHostname=='{source_router}')\r\n| where isnotempty(NetflowElement_9_2239) and isnotempty(NetflowFwDestAddrIpv4)\r\n| evaluate ipv4_lookup(IP_Data, NetflowFwDestAddrIpv4, network)\r\n| summarize count() by network, country_name", "size": 0, "showAnalytics": true, "title": "Top Destination Countries", "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "map", "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "country_name", "latitude": "src_ip_s", "longitude": "src_ip_s", "sizeSettings": "count_", "sizeAggregation": "Sum", "legendMetric": "count_", "numberOfMetrics": 10, "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "count_", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "name": "query - 6 - Copy", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### Top Network Talkers" }, "name": "text - 8" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "3ae21293-a377-4817-a6e4-eb0f842a61d3", "version": "KqlParameterItem/1.0", "name": "top_network_talkers_count", "label": "Top", "type": 2, "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n { \"value\":10, \"label\":\" 10 \", \"selected\":true },\r\n { \"value\":25, \"label\":\" 25 \" },\r\n { \"value\":50, \"label\":\" 50 \" }\r\n]" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSDWANNetflow\r\n| where ('*'=='{source_router}' or NetflowHostname=='{source_router}')\r\n| where isnotempty(NetflowElement_9_2239) and isnotempty(NetflowBytesIn)\r\n| summarize [\"Total Bytes (MB)\"] = round((sum(toint(NetflowBytesIn))/1024)/1024, 2) by NetflowFwSrcAddrIpv4, NetflowFwDestAddrIpv4\r\n| sort by [\"Total Bytes (MB)\"] | limit toint('{top_network_talkers_count}')\r\n| project [\"Source IP Address\"] = NetflowFwSrcAddrIpv4, [\"Destination IP Address\"] = NetflowFwDestAddrIpv4, [\"Total Bytes (MB)\"]", "size": 0, "showAnalytics": true, "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "Source IP Address", "parameterName": "tnt_source_ip", "parameterType": 1, "defaultValue": "none" }, { "fieldName": "Destination IP Address", "parameterName": "tnt_dest_ip", "parameterType": 1, "defaultValue": "none" } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Total Bytes (MB)", "formatter": 4, "formatOptions": { "min": 0, "palette": "greenRed" } } ], "rowLimit": 10000, "filter": true } }, "name": "query - 9", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSDWANNetflow\r\n| where ('*'=='{source_router}' or NetflowHostname =='{source_router}')\r\n| where isnotempty(NetflowElement_9_2239) and isnotempty(NetflowBytesIn)\r\n| where NetflowFwSrcAddrIpv4 == '{tnt_source_ip}' and NetflowFwDestAddrIpv4 == '{tnt_dest_ip}' | sort by TimeStamp | project-away Agent*, _ResourceId, _SubscriptionId, ECSVersion, Host*, RawData", "size": 0, "showAnalytics": true, "title": "Netflow Events (Top Network Talkers: {tnt_source_ip} (Source IP) and {tnt_dest_ip} (Destination IP))", "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibilities": [ { "parameterName": "tnt_source_ip", "comparison": "isNotEqualTo", "value": "none" }, { "parameterName": "tnt_dest_ip", "comparison": "isNotEqualTo", "value": "none" } ], "name": "query - 10", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### Communications Map between Sources and Destinations" }, "name": "text - 11" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "6d1a0b73-fd46-4f95-a7e7-87dfe1cca2e5", "version": "KqlParameterItem/1.0", "name": "ls_protocol", "label": "Protocol", "type": 2, "isRequired": true, "query": "CiscoSyslogFW6LogSummary\r\n| where ('*'=='{source_router}' or Host=='{source_router}')\r\n| distinct Protocol\r\n | order by Protocol asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "defaultValue": "value::all", "timeContext": { "durationMs": 2419200000 }, "timeContextFromParameter": "time_range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "c98dedf3-2399-4470-8700-c9023529c2e9", "version": "KqlParameterItem/1.0", "name": "ls_top_count", "label": "Top", "type": 2, "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n { \"value\":10, \"label\":\" 10 \", \"selected\":true },\r\n { \"value\":25, \"label\":\" 25 \" },\r\n { \"value\":50, \"label\":\" 50 \" }\r\n]" }, { "id": "90a0db3a-bf45-4b6b-b466-e8b25efab754", "version": "KqlParameterItem/1.0", "name": "ls_target", "label": "Target", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "CiscoSyslogFW6LogSummary\r\n| where ('*' == '{source_router}' or Host=='{source_router}') and ('*' == '{ls_protocol}' or Protocol=='{ls_protocol}')\r\n| where isnotempty(SyslogTarget) | distinct SyslogTarget | order by SyslogTarget asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "280cf7c3-5dad-4aee-ae9c-cbb20d239f21", "version": "KqlParameterItem/1.0", "name": "ls_class", "label": "Class", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "CiscoSyslogFW6LogSummary\r\n| where ('*' == '{source_router}' or Host=='{source_router}') and ('*' == '{ls_protocol}' or Protocol=='{ls_protocol}')\r\n| where isnotempty(SyslogClass) | distinct SyslogClass | order by SyslogClass asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 2419200000 }, "timeContextFromParameter": "time_range", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 12" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "af0794f0-b24f-43fb-b43f-9271c784f280", "version": "KqlParameterItem/1.0", "name": "ls_source_ip", "label": "Source IPs", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "CiscoSyslogFW6LogSummary\r\n| where ('*' == '{source_router}' or Host=='{source_router}') and ('*' == '{ls_protocol}' or Protocol=='{ls_protocol}') and ('*' in ({ls_target}) or SyslogTarget in ({ls_target})) and ('*' in ({ls_class}) or SyslogClass in ({ls_class}))\r\n| distinct SourceIP | order by SourceIP asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] }, { "id": "1896111d-9468-453b-848e-6697e42a2b67", "version": "KqlParameterItem/1.0", "name": "ls_dest_ip", "label": "Destination IPs", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "CiscoSyslogFW6LogSummary\r\n| where ('*' == '{source_router}' or Host=='{source_router}') and ('*' == '{ls_protocol}' or Protocol=='{ls_protocol}') and ('*' in ({ls_target}) or SyslogTarget in ({ls_target})) and ('*' in ({ls_class}) or SyslogClass in ({ls_class}))\r\n| distinct DestinationIP | order by DestinationIP asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_range", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 13" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSyslogFW6LogSummary\r\n| where ('*' == '{source_router}' or Host=='{source_router}') and ('*' == '{ls_protocol}' or Protocol=='{ls_protocol}') and ('*' in ({ls_target}) or SyslogTarget in ({ls_target})) and ('*' in ({ls_class}) or SyslogClass in ({ls_class})) and ('*' in ({ls_source_ip}) or SourceIP in ({ls_source_ip})) and ('*' in ({ls_dest_ip}) or DestinationIP in ({ls_dest_ip}))\r\n| summarize count() by SourceIP, DestinationIP\r\n| sort by count_ | limit toint('{ls_top_count}')\r\n| project ['Source IP Address'] = SourceIP, ['Destination IP Address'] = DestinationIP, ['Connections'] = count_", "size": 0, "showAnalytics": true, "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "Source IP Address", "parameterName": "cm_source_ip", "parameterType": 1, "defaultValue": "none" }, { "fieldName": "Destination IP Address", "parameterName": "cm_dest_ip", "parameterType": 1, "defaultValue": "none" } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Connections", "formatter": 4, "formatOptions": { "min": 0, "palette": "greenRed", "customColumnWidthSetting": "10%" } } ], "rowLimit": 10000, "filter": true } }, "name": "query - 14", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CiscoSyslogFW6LogSummary\r\n| where ('*' == '{source_router}' or Host=='{source_router}') and ('*' == '{ls_protocol}' or Protocol=='{ls_protocol}') and ('*' in ({ls_target}) or SyslogTarget in ({ls_target})) and ('*' in ({ls_class}) or SyslogClass in ({ls_class})) and ('*' in ({ls_source_ip}) or SourceIP in ({ls_source_ip})) and ('*' in ({ls_dest_ip}) or DestinationIP in ({ls_dest_ip}))\r\n| where SourceIP == '{cm_source_ip}' and DestinationIP == '{cm_dest_ip}'\r\n| sort by TimeGenerated", "size": 0, "showAnalytics": true, "title": "Syslog Events (Communications Map between Sources and Destinations: {cm_source_ip} (Source IP) and {cm_dest_ip} (Destination IP))", "noDataMessage": "No data was found in the selected time range.", "timeContextFromParameter": "time_range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibilities": [ { "parameterName": "cm_source_ip", "comparison": "isNotEqualTo", "value": "none" }, { "parameterName": "cm_dest_ip", "comparison": "isNotEqualTo", "value": "none" } ], "name": "query - 15", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "πŸ“Β Refresh the web page to fetch details of recently collected events." }, "name": "text - 17" } ] }, "conditionalVisibility": { "parameterName": "setTab", "comparison": "isEqualTo", "value": "Flow Analysis" }, "name": "group - 4" } ], "fromTemplateId": "sentinel-CiscoSDWAN", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }