{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "" ], "parameters": [ { "id": "b747fcd2-3083-4db5-b417-bb3d20d12bb2", "version": "KqlParameterItem/1.0", "name": "Workspace", "type": 5, "query": "resources\r\n| where type == 'microsoft.operationalinsights/workspaces'\r\n| project id, name", "crossComponentResources": [ "value::selected" ], "typeSettings": { "additionalResourceOptions": [] }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": "" }, { "id": "31433d20-d3a7-4fc4-ada7-974de005b1a9", "version": "KqlParameterItem/1.0", "name": "Time", "type": 4, "typeSettings": { "selectableValues": [ { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 2592000000 } }, { "id": "17ea99e0-281a-4fba-91d7-41f60dbe644d", "version": "KqlParameterItem/1.0", "name": "Help", "type": 10, "isRequired": true, "typeSettings": { "additionalResourceOptions": [] }, "jsonData": "[\"Yes\", \"No\"]", "value": "No" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parameters - 1" }, { "type": 1, "content": { "json": "### Help\r\n\r\nThis workbook is meant to highlight tasks and incidents with tasks. The workbook is broken up into two main sections:
\r\n- Incident view: The view that will highlight incidents with tasks that are open, closed, or deleted, as well as who is owning incidents with tasks.\r\n- Metric view: The view that will highlight metrics around SOC performance with tasks that may provide insights into what is working well vs. not well.\r\n\r\n", "style": "info" }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "text - 4" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "2ea9d7ae-e260-407b-8f46-52cd14f08999", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Incident View", "subTarget": "1", "style": "link", "tabWidth": "500px" }, { "id": "fbfea602-d24d-4fa8-ac8d-21d8db3d31c5", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Metric View", "subTarget": "2", "style": "link", "tabWidth": "500px" } ] }, "name": "links - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "c79f5958-de0b-49c9-a4a3-5bae1fd834a4", "version": "KqlParameterItem/1.0", "name": "Filter", "label": "Filter By", "type": 10, "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\"Incident\", \"Owner\"]", "timeContext": { "durationMs": 86400000 }, "value": "Owner" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 3" }, { "type": 1, "content": { "json": "### Help\r\n\r\n*If using the Incident view*
\r\nThis view will show the latest 250 incidents that have or have had tasks. Incidents are grouped together by title to help show which are most common. Incidents are arranged in the amount of time open from oldest to newest.\r\n\r\n*If using the Owner view*
\r\nThis view will show both unassigned incidents that contain tasks and incidents that are owned. Incidents that are unassigned are grouped by title while the owned incidents are grouped by owner.
\r\n\r\nTo see task details on an incident:
\r\n1. Click on the arrow next to a title to expand the group.\r\n2. Click on the arrow next to the incident number to expand the log for the incident.\r\n3. Click on the incident log to populate the task information below the incident list.\r\n4. Review the tasks information in the sections below.", "style": "info" }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "text - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| summarize arg_max(TimeGenerated,*) by tostring(IncidentNumber)\r\n| extend TimeOpen = datetime_diff('minute', now(), CreatedTime)\r\n| project IncidentNumber, Title, Description, TimeGenerated, Severity, Status, TimeOpen, Tasks, TaskCount = array_length(Tasks), ProviderName, IncidentName\r\n| where Status != 'Closed'\r\n| where TaskCount > 0\r\n| order by TimeOpen desc", "size": 2, "title": "Incidents in {Workspace:name}", "timeContextFromParameter": "Time", "exportedParameters": [ { "fieldName": "IncidentNumber", "parameterName": "IncidentNumber" }, { "fieldName": "IncidentName", "parameterName": "IncidentName", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "98.8571ch" } }, { "columnMatch": "Group", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "98.8571ch" } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Informational", "representation": "gray", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "TimeOpen", "formatter": 0, "numberFormat": { "unit": 25, "options": { "style": "decimal" } } }, { "columnMatch": "Tasks", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "$gen_group", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "98.8571ch" } } ], "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "Title", "IncidentNumber" ] } } }, "conditionalVisibility": { "parameterName": "Filter", "comparison": "isEqualTo", "value": "Incident" }, "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| summarize arg_max(TimeGenerated,*) by tostring(IncidentNumber)\r\n| extend TimeOpen = datetime_diff('minute', now(), CreatedTime)\r\n| project IncidentNumber, Title, Owner = iff(isempty(Owner.email), 'Unassigned', Owner.email), Description, TimeGenerated, Severity, Status, TimeOpen, Tasks, TaskCount = array_length(Tasks), ProviderName, IncidentName\r\n| where TaskCount > 0\r\n| where Owner == 'Unassigned'\r\n| where Status !has 'Closed'\r\n| order by TimeOpen desc", "size": 2, "showAnalytics": true, "title": "Unassigned Incidents with Tasks", "timeContextFromParameter": "Time", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "IncidentNumber", "parameterName": "IncidentNumber" }, { "fieldName": "IncidentName", "parameterName": "IncidentName", "parameterType": 1 } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "68.5714ch" } }, { "columnMatch": "Group", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "68.5714ch" } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Informational", "representation": "gray", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "TimeOpen", "formatter": 0, "numberFormat": { "unit": 25, "options": { "style": "decimal" } } }, { "columnMatch": "Tasks", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "$gen_group", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "68.5714ch" } } ], "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "Title", "IncidentNumber" ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Filter", "comparison": "isEqualTo", "value": "Owner" }, "name": "query - 0 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| summarize arg_max(TimeGenerated,*) by tostring(IncidentNumber)\r\n| extend TimeOpen = datetime_diff('minute', now(), CreatedTime)\r\n| project IncidentNumber, Title, Owner = iff(isempty(Owner.email), 'Unassigned', Owner.email), Description, TimeGenerated, Severity, Status, TimeOpen, Tasks, TaskCount = array_length(Tasks), ProviderName, IncidentName\r\n| where TaskCount > 0\r\n| where Owner != 'Unassigned'\r\n| where Status !has 'Closed'\r\n| order by IncidentNumber desc", "size": 2, "showAnalytics": true, "title": "Owned Incidents with Tasks", "timeContextFromParameter": "Time", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "IncidentNumber", "parameterName": "IncidentNumber" }, { "fieldName": "IncidentName", "parameterName": "IncidentName", "parameterType": 1 } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "89ch" } }, { "columnMatch": "Group", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "89ch" } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Informational", "representation": "gray", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "TimeOpen", "formatter": 0, "numberFormat": { "unit": 25, "options": { "style": "decimal" } } }, { "columnMatch": "Tasks", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true } }, { "columnMatch": "$gen_group", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "89ch" } } ], "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "Owner", "Title" ] } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Filter", "comparison": "isEqualTo", "value": "Owner" }, "name": "query - 0 - Copy - Copy" }, { "type": 1, "content": { "json": "### Help\r\n\r\nThis section will provide logs on tasks that belonged to the select incident above. If it is saying to select an IncidentNumber, follow the steps above to find and select an incident.
\r\n\r\nIf looking take action on the selected incident or tasks, there are 3 buttons available:\r\n1. Open incident: This button will open the incident blade for the selected incident, allowing users to get access to the full picture of the incident while being able to act on tasks, logs, and automation.\r\n2. Open Tasks: This button will open the sub-menu from the incident blade to show all tasks of the selected incident. Users can view, update, or add tasks from this menu.\r\n3. Run automation: This button will open the run automation sub-menu from the incident blade. This allows users to run automation on the incident directly from the workbook without having to leave.", "style": "info" }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "text - 9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| where IncidentNumber in ({IncidentNumber})\r\n| project Tasks\r\n| mv-expand Tasks\r\n| evaluate bag_unpack(Tasks)\r\n| summarize arg_max(lastModifiedTimeUtc, *) by taskId\r\n| where status != 'Completed'\r\n| order by lastModifiedTimeUtc desc\r\n| extend TimeOpen = datetime_diff('minute', now(), createdTimeUtc)\r\n| project Title = ['title'], Status = ['status'], createdTimeUtc, lastModifiedTimeUtc, TimeOpen, Creator = ['createdBy'].name, lastModifiedBy, ModifiedBy = ['lastModifiedBy'].name\r\n| order by createdTimeUtc desc", "size": 0, "showAnalytics": true, "title": "Open Tasks for Selected Incident", "timeContextFromParameter": "Time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "TimeOpen", "formatter": 0, "numberFormat": { "unit": 25, "options": { "style": "decimal" } } }, { "columnMatch": "Group", "formatter": 1 } ], "filter": true } }, "showPin": false, "name": "query - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "paragraph", "links": [ { "id": "be028955-0e47-4c00-8470-0d438689b031", "linkTarget": "OpenBlade", "linkLabel": "Open Incident", "style": "primary", "bladeOpenContext": { "bladeName": "IncidentPage.ReactView", "extensionName": "Microsoft_Azure_Security_Insights", "bladeJsonParameters": "{\r\n \"incidentArmId\": \"{Workspace}/providers/Microsoft.SecurityInsights/Incidents/{IncidentName}\"\r\n}" } }, { "id": "b4c2c3a2-3d9a-4ff7-8ff4-963186e8a765", "linkTarget": "OpenBlade", "linkLabel": "Open Incident Tasks", "style": "primary", "linkIsContextBlade": true, "bladeOpenContext": { "bladeName": "IncidentTasksPage.ReactView", "extensionName": "Microsoft_Azure_Security_Insights", "bladeJsonParameters": "{\r\n \"incidentArmId\": \"{Workspace}/providers/Microsoft.SecurityInsights/Incidents/{IncidentName}\"\r\n}" } }, { "id": "4d829d94-3c0f-41f9-8a4f-c105373aaa2b", "cellValue": "", "linkTarget": "OpenBlade", "linkLabel": "Open Workspace", "subTarget": "logs", "style": "primary", "linkIsContextBlade": true, "bladeOpenContext": { "bladeName": "LogsBlade", "extensionName": "Microsoft_Azure_Monitoring_Logs", "bladeJsonParameters": "{\r\n \"scope\": {\r\n \"resources\": [\r\n {\r\n \"resourceId\": \"{Workspace}\"\r\n }\r\n ]\r\n },\r\n \"source\": \"LogsBlade.Log Analytics\"\r\n}" } }, { "id": "216e30bb-4f27-4434-981d-aa1abfce8591", "linkTarget": "OpenBlade", "linkLabel": "Run Automation", "style": "primary", "linkIsContextBlade": true, "bladeOpenContext": { "bladeName": "ManualTriggerBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeJsonParameters": "{\r\n \"targetObjectType\": 0,\r\n \"targetObjectArmId\": \"{Workspace}/providers/Microsoft.SecurityInsights/Incidents/{IncidentName}\"\r\n}" } } ] }, "name": "links - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| where IncidentNumber in ({IncidentNumber})\r\n| project Tasks\r\n| mv-expand Tasks\r\n| evaluate bag_unpack(Tasks)\r\n| summarize arg_max(lastModifiedTimeUtc, *) by taskId\r\n| where status == 'Completed'\r\n| extend TimeOpen = datetime_diff('minute', now(), createdTimeUtc)\r\n| project Title = ['title'], Status = ['status'], createdTimeUtc, lastCompletedTimeUtc = column_ifexists(\"lastCompletedTimeUtc\", datetime(null)), lastModifiedTimeUtc = column_ifexists(\"lastModifiedTimeUtc\", datetime(null)), TimeOpen, Creator = ['createdBy'].name, lastModifiedBy, Closer = ['lastModifiedBy'].name\r\n| order by lastCompletedTimeUtc desc\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Closed Tasks for Selected Incident", "noDataMessage": "No Completed Tasks for This Incident.", "timeContextFromParameter": "Time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "TimeOpen", "formatter": 0, "numberFormat": { "unit": 25, "options": { "style": "decimal" } } }, { "columnMatch": "Group", "formatter": 1 } ], "filter": true } }, "name": "query - 2 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| where IncidentNumber in ({IncidentNumber})\r\n| project Tasks\r\n| mv-expand Tasks\r\n| evaluate bag_unpack(Tasks)\r\n| summarize arg_max(lastModifiedTimeUtc, *) by taskId\r\n| where status == 'Deleted'\r\n| extend TimeOpen = datetime_diff('minute', now(), createdTimeUtc)\r\n| project Title = ['title'], Status = ['status'], createdTimeUtc, lastModifiedTimeUtc = column_ifexists(\"lastModifiedTimeUtc\", datetime(null)), TimeOpen, Creator = ['createdBy'].name, lastModifiedBy, Closer = ['lastModifiedBy'].name\r\n| order by lastModifiedTimeUtc desc\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Deleted Tasks for Selected Incident", "timeContextFromParameter": "Time", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Group", "formatter": 1 } ], "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "title" ] } } }, "showPin": false, "name": "query - 2 - Copy - Copy" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "1" }, "name": "Incident" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "### Help\r\n\r\nThis tab will highlight metrics around tasks within this workspace. The goal is to highlight key areas such as:\r\n- how many incidents do not have tasks\r\n- how many tasks have been completed\r\n- number of tasks per owner\r\n- average time to completion per task title\r\n\r\nThese metrics may assist in finding if there are areas that need to be improved.\r\n\r\nThe timeline below highlights the trend of incident creation over the selected time period. Time brushing is enabled on the timechart so a period can be highlighted and the metrics below will change to reflect the highlighted period. \r\n\r\n#### Please note: There may be errors that appear in the metrics if the selected workspace does not have any tasks that have been created. These will go away once tasks begin to populate the metrics.", "style": "info" }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "name": "text - 14" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident \r\n| where CreatedTime >= {Time:start} and CreatedTime <= {Time:end}\r\n| summarize arg_max(TimeGenerated, Status, Severity, Owner, AdditionalData,CreatedTime) by IncidentNumber\r\n| extend Tactics = todynamic(AdditionalData.tactics)\r\n| extend Owner = todynamic(Owner.assignedTo) \r\n| extend Product = todynamic((parse_json(tostring(AdditionalData.alertProductNames))[0])) \r\n| summarize count() by bin(CreatedTime, 1h)\r\n\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Incidents Over Time", "timeContextFromParameter": "Time", "timeBrushParameterName": "TimeBrush", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "timechart" }, "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| project Tasks\r\n| mv-expand Tasks\r\n| evaluate bag_unpack(Tasks)\r\n| extend taskId = column_ifexists(\"taskId\", \"null\"), lastModifiedTimeUtc = column_ifexists(\"lastCompletedTimeUtc\", datetime(null))\r\n| order by lastModifiedTimeUtc desc\r\n| summarize arg_max(lastModifiedTimeUtc, *) by taskId\r\n| summarize Tasks = count()", "size": 0, "title": "Total Number of Tasks During Time Period", "timeContextFromParameter": "TimeBrush", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "card", "textSettings": { "style": "bignumber" } }, "customWidth": "20", "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| project Tasks\r\n| mv-expand Tasks\r\n| evaluate bag_unpack(Tasks)\r\n| extend taskId = column_ifexists(\"taskId\", \"null\"), lastModifiedTimeUtc = column_ifexists(\"lastCompletedTimeUtc\", datetime(null)), status = column_ifexists(\"status\", \"null\")\r\n| where status == 'Completed'\r\n| order by lastModifiedTimeUtc desc\r\n| summarize arg_max(lastModifiedTimeUtc, *) by taskId\r\n| summarize Tasks = count()", "size": 0, "title": "Total Number of Tasks Closed During Time Period", "timeContextFromParameter": "TimeBrush", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "card", "textSettings": { "style": "bignumber" } }, "customWidth": "20", "name": "query - 5 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let TCount = (SecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentName\r\n| summarize TCount = count());\r\nlet WOCount = (SecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentName\r\n| where Tasks == '[]'\r\n| summarize WOCount = count());\r\nlet Percent = (WOTask:double, Total:double) {\r\n print Percentage = (WOTask/Total) * 100\r\n};\r\nPercent(toscalar(WOCount),toscalar(TCount))\r\n", "size": 0, "title": "Percent of Incidents without Tasks", "timeContextFromParameter": "TimeBrush", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Percentage", "formatter": 0, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } }, { "columnMatch": "print_0", "formatter": 0, "numberFormat": { "unit": 0, "options": { "style": "decimal", "minimumIntegerDigits": 3, "minimumFractionDigits": 3, "maximumFractionDigits": 3, "minimumSignificantDigits": 3 } } } ] }, "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Percentage", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } }, "showBorder": false }, "textSettings": { "style": "bignumber" } }, "customWidth": "20", "name": "query - 9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| where Tasks != '[]'\r\n| project Tasks\r\n| mv-expand Tasks\r\n| evaluate bag_unpack(Tasks)\r\n| extend lastModifiedTimeUtc = column_ifexists(\"lastCompletedTimeUtc\", datetime(null)), taskId = column_ifexists(\"taskId\", \"null\"), createdBy = column_ifexists(\"createdBy\", \"null\")\r\n| extend createdBy = todynamic(createdBy)\r\n| summarize arg_max(lastModifiedTimeUtc, *) by taskId\r\n| extend Creator = iff(isempty(createdBy.email), 'Empty', tostring(createdBy.email))\r\n| summarize Tasks = count() by Creator\r\n| order by Tasks desc", "size": 0, "title": "Number of Tasks Created by Owner", "timeContextFromParameter": "TimeBrush", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "20", "name": "query - 5 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| where Tasks != '[]'\r\n| project Tasks\r\n| mv-expand Tasks\r\n| evaluate bag_unpack(Tasks)\r\n| extend lastModifiedTimeUtc = column_ifexists(\"lastCompletedTimeUtc\", datetime(null)), taskId = column_ifexists(\"taskId\", \"null\"), status = column_ifexists(\"status\", \"null\")\r\n| summarize arg_max(lastModifiedTimeUtc, *) by taskId\r\n| summarize Tasks = count() by status\r\n| order by Tasks desc", "size": 0, "title": "Number of Tasks by Status", "timeContextFromParameter": "TimeBrush", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "20", "name": "query - 5 - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| where ClosedTime >= {Time:start} and ClosedTime <= {Time:end}\r\n| where Tasks != '[]'\r\n| project Tasks\r\n| mv-expand Tasks\r\n| evaluate bag_unpack(Tasks)\r\n| extend lastModifiedTimeUtc = column_ifexists(\"lastModifiedTimeUtc\", datetime(null)), taskId = column_ifexists(\"taskId\", \"null\"), status = column_ifexists(\"status\", \"null\"),lastCompletedTimeUtc = column_ifexists(\"lastCompletedTimeUtc\", datetime(null)), createdTimeUtc = column_ifexists(\"createdTimeUtc\", datetime(null))\r\n| summarize arg_max(lastModifiedTimeUtc, *) by taskId\r\n| extend TimeToClosure = (lastCompletedTimeUtc - createdTimeUtc)/1h\r\n| summarize 50th_Percentile=percentile(TimeToClosure, 50)", "size": 0, "title": "Mean time to closure ", "timeContextFromParameter": "TimeBrush", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "50th_Percentile", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 26, "options": { "style": "decimal" } } }, "showBorder": false }, "textSettings": { "style": "bignumber" } }, "customWidth": "20", "name": "query - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let TaskCount = SecurityIncident\r\n| project Tasks\r\n| mv-expand Tasks\r\n| evaluate bag_unpack(Tasks)\r\n| extend lastModifiedTimeUtc = column_ifexists(\"lastModifiedTimeUtc\", datetime(null)), taskId = column_ifexists(\"taskId\", \"null\"), status = column_ifexists(\"status\", \"null\"),lastCompletedTimeUtc = column_ifexists(\"lastCompletedTimeUtc\", datetime(null)), createdTimeUtc = column_ifexists(\"createdTimeUtc\", datetime(null)), title = column_ifexists(\"title\", \"null\")\r\n| summarize arg_max(lastModifiedTimeUtc, *) by taskId\r\n| where isnotempty(lastCompletedTimeUtc)\r\n| summarize Count = count() by Title = ['title'];\r\nlet TotalTime = SecurityIncident\r\n| project Tasks\r\n| mv-expand Tasks\r\n| evaluate bag_unpack(Tasks)\r\n| extend lastModifiedTimeUtc = column_ifexists(\"lastModifiedTimeUtc\", datetime(null)), taskId = column_ifexists(\"taskId\", \"null\"), status = column_ifexists(\"status\", \"null\"),lastCompletedTimeUtc = column_ifexists(\"lastCompletedTimeUtc\", datetime(null)), createdTimeUtc = column_ifexists(\"createdTimeUtc\", datetime(null)), title = column_ifexists(\"title\", \"null\")\r\n| summarize arg_max(lastModifiedTimeUtc, *) by taskId\r\n| where isnotempty(lastCompletedTimeUtc)\r\n| extend Time = datetime_diff('minute', lastCompletedTimeUtc, createdTimeUtc)\r\n| summarize TotalTime = sum(Time) by Title = ['title'];\r\nTaskCount\r\n| join kind=leftouter TotalTime on Title\r\n| extend AvgTime = TotalTime/Count\r\n| project Title, AvgTime\r\n| order by AvgTime desc", "size": 0, "showAnalytics": true, "title": "Average Time to Completion per Task", "timeContextFromParameter": "TimeBrush", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AvgTime", "formatter": 0, "numberFormat": { "unit": 25, "options": { "style": "decimal" } } }, { "columnMatch": "Completion Time", "formatter": 0, "numberFormat": { "unit": 25, "options": { "style": "decimal" } } }, { "columnMatch": "AvComp", "formatter": 0, "numberFormat": { "unit": 25, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "25", "name": "query - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| project Tasks\r\n| mv-expand Tasks\r\n| evaluate bag_unpack(Tasks)\r\n| extend lastModifiedTimeUtc = column_ifexists(\"lastModifiedTimeUtc\", datetime(null)), taskId = column_ifexists(\"taskId\", \"null\"), status = column_ifexists(\"status\", \"null\"),lastCompletedTimeUtc = column_ifexists(\"lastCompletedTimeUtc\", datetime(null)), createdTimeUtc = column_ifexists(\"createdTimeUtc\", datetime(null)), title = column_ifexists(\"title\", \"null\"), createdBy = column_ifexists(\"createdBy\", \"null\")\r\n| summarize arg_max(lastModifiedTimeUtc, *) by taskId\r\n| extend Creator = todynamic(createdBy).name\r\n| where Creator !has 'automation rule' \r\n| where Creator !has 'playbook'\r\n| summarize Count = count() by Title = ['title'], tostring(Creator)\r\n| order by Count desc\r\n", "size": 0, "showAnalytics": true, "title": "Count per Task Added Manually", "timeContextFromParameter": "TimeBrush", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "filter": true } }, "customWidth": "30", "name": "query - 11" }, { "type": 1, "content": { "json": "### Potentially Useful Tools\r\n---------------------------------------------------" }, "name": "text - 12" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "a9b3932a-e140-498f-97f4-da4ffcad5a4a", "version": "KqlParameterItem/1.0", "name": "selectedWorkbook", "label": "Select Workbook", "type": 2, "isGlobal": true, "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n {\\\"value\\\": \\\"SecurityOperationsEfficiency.json\\\", \\\"label\\\": \\\"SOC Efficiency Report\\\", \\\"tags\\\": [\\\"SOC\\\"]},\\r\\n\\t{\\\"value\\\": \\\"InvestigationInsights.json\\\", \\\"label\\\": \\\"Investigation Insights\\\", \\\"tags\\\" : [\\\"incident\\\"]}\\r\\n]\",\"transformers\":null}", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 8, "value": "InvestigationInsights.json" }, { "id": "1772f659-c2b1-4882-a26b-63feb82ab734", "version": "KqlParameterItem/1.0", "name": "WorkbookRenderWhere", "label": "Where to Open", "type": 10, "description": "Select the area where to render the selected workbook", "isRequired": true, "isGlobal": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\"Context Pane\",\"Tab\",\"Full Screen\", \"Close Workbook\"]", "value": "Context Pane" }, { "id": "49ce5797-eb8c-4616-94a6-14b9a92606b4", "version": "KqlParameterItem/1.0", "name": "templateBaseUrl", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "https://securityinsights.hosting.portal.azure.net/securityinsights/Content/Workbooks" } } ] } ], "style": "above", "queryType": 8 }, "name": "parameters - 3" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "6587fa50-dc9c-46b7-ba95-b2b48b6c9733", "cellValue": "{templateBaseUrl}/{selectedWorkbook}", "linkTarget": "WorkbookTemplate", "linkLabel": "Open Workbook", "preText": "📘", "style": "secondary", "linkIsContextBlade": true, "workbookContext": { "componentIdSource": "workbook", "resourceIdsSource": "workbook", "templateIdSource": "cell", "typeSource": "static", "type": "sentinel", "gallerySource": "static", "gallery": "sentinel", "locationSource": "workbook", "passSpecificParams": true, "templateParameters": [ { "name": "Workspace", "source": "parameter", "value": "workspace" }, { "name": "Subscription", "source": "parameter", "value": "subscriptionId" }, { "name": "subscriptionId", "source": "parameter", "value": "subscriptionId" }, { "name": "resourceGroup", "source": "parameter", "value": "resourceGroup" } ] } } ] }, "conditionalVisibility": { "parameterName": "WorkbookRenderWhere", "comparison": "isEqualTo", "value": "Context Pane" }, "name": "links - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "template", "loadFromTemplateId": "https://securityinsights.hosting.portal.azure.net/securityinsights/Content/Workbooks/AMAmigrationTracker.json", "items": [] }, "conditionalVisibility": { "parameterName": "selectedWorkbook", "comparison": "isEqualTo", "value": "AMAmigrationTracker.json" }, "name": "AMA Migration Tracker" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "template", "loadFromTemplateId": "https://securityinsights.hosting.portal.azure.net/securityinsights/Content/Workbooks/MicrosoftSentinelDeploymentandMigrationTracker.json", "items": [] }, "conditionalVisibility": { "parameterName": "selectedWorkbook", "comparison": "isEqualTo", "value": "MicrosoftSentinelDeploymentandMigrationTracker.json" }, "name": "Microosft Sentinel Deployment and Migration Tracker" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "template", "loadFromTemplateId": "https://securityinsights.hosting.portal.azure.net/securityinsights/Content/Workbooks/WorkspaceUsage.json", "items": [] }, "conditionalVisibility": { "parameterName": "selectedWorkbook", "comparison": "isEqualTo", "value": "WorkspaceUsage.json" }, "name": "Microosft Sentinel Deployment and Migration Tracker - Copy" } ] }, "conditionalVisibility": { "parameterName": "WorkbookRenderWhere", "comparison": "isEqualTo", "value": "Tab" }, "name": "Workbook Tabs Group" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "023a9468-b62b-479e-8cbe-d1f2d4c90303", "cellValue": "{templateBaseUrl}/{selectedWorkbook}", "linkTarget": "WorkbookTemplate", "linkLabel": "Open Workbook", "preText": "📘", "style": "secondary", "workbookContext": { "componentIdSource": "workbook", "resourceIdsSource": "workbook", "templateIdSource": "cell", "typeSource": "static", "type": "sentinel", "gallerySource": "static", "gallery": "sentinel", "locationSource": "workbook", "passSpecificParams": true, "templateParameters": [ { "name": "Workspace", "source": "parameter", "value": "workspace" }, { "name": "Subscription", "source": "parameter", "value": "subscriptionId" }, { "name": "subscriptionId", "source": "parameter", "value": "subscriptionId" }, { "name": "resourceGroup", "source": "parameter", "value": "resourceGroup" } ] } } ] }, "conditionalVisibility": { "parameterName": "WorkbookRenderWhere", "comparison": "isEqualTo", "value": "Full Screen" }, "name": "Open Workbook - Full Screen" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "2" }, "name": "Metrics" } ], "fallbackResourceIds": [ "" ], "fromTemplateId": "sentinel-IncidentTasksWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }