{ "version": "Notebook/1.0", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "cellValue": "workbook-group", "linkTarget": "parameter", "linkLabel": "Cognito Detect", "subTarget": "detect", "style": "link" }, { "cellValue": "workbook-group", "linkTarget": "parameter", "linkLabel": "Health", "subTarget": "health", "style": "link" }, { "cellValue": "workbook-group", "linkTarget": "parameter", "linkLabel": "Audit", "subTarget": "audit", "style": "link" } ] }, "name": "Links" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "cellValue": "workbook", "linkTarget": "parameter", "linkLabel": "Overview", "subTarget": "Overview", "style": "link" }, { "cellValue": "workbook", "linkTarget": "parameter", "linkLabel": "Hosts", "subTarget": "Hosts", "style": "link" }, { "cellValue": "workbook", "linkTarget": "parameter", "linkLabel": "Accounts", "subTarget": "Accounts", "style": "link" }, { "cellValue": "workbook", "linkTarget": "parameter", "linkLabel": "Detections", "subTarget": "Detections", "style": "link" }, { "cellValue": "workbook", "linkTarget": "parameter", "linkLabel": "Campaigns", "subTarget": "Campaigns", "style": "link" } ] }, "conditionalVisibility": { "parameterName": "workbook-group", "comparison": "isEqualTo", "value": "detect" }, "name": "Detect Links" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "521734b3-6af4-48dc-b622-3f3dd3e1bdeb", "version": "KqlParameterItem/1.0", "name": "time_token", "label": "Timerange", "type": 4, "isRequired": true, "value": { "durationMs": 86400000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "resourceType": "microsoft.insights/components" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Overview - Parameters" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "datatable (Count:long, status:string, status_count:long) [0,\"Low\",1, 0,\"Medium\",2, 0,\"High\",3, 0,\"Critical\",4]\r\n|union\r\n(\r\nCommonSecurityLog\r\n| where DeviceVendor==\"Vectra Networks\" and DeviceEventClassID==\"hsc\"\r\n| extend src = coalesce(SourceHostName, SourceIP)\r\n| summarize arg_max(TimeGenerated, *) by src\r\n| extend status = case(FlexNumber1>=50 and FlexNumber2<50, \"High\",\r\n FlexNumber1>=50 and FlexNumber2>=50, \"Critical\",\r\n FlexNumber1<50 and FlexNumber2>=50, \"Medium\",\r\n FlexNumber1>0 and FlexNumber1<50 and FlexNumber2>0 and FlexNumber2<50,\"Low\",\r\n \"True\"\r\n )\r\n| where status != \"True\"\r\n| extend status_count = case(status==\"Critical\", 4, status==\"High\", 3, status==\"Medium\", 2, 1)\r\n| summarize Count = count() by status, status_count\r\n)\r\n| summarize Count=sum(Count) by status, status_count\r\n| sort by status_count asc", "size": 4, "showAnalytics": true, "title": "Hosts Count By Severity", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_token", "exportFieldName": "status", "exportParameterName": "status", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "status", "formatter": 18, "formatOptions": { "showIcon": true, "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "green", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "showIcon": true }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 }, "emptyValCustomText": "0" } }, "showBorder": true, "sortCriteriaField": "status_count", "sortOrderField": 1 }, "graphSettings": { "type": 2, "topContent": { "columnMatch": "status", "formatter": 1, "formatOptions": { "showIcon": true } }, "centerContent": { "columnMatch": "status_count", "formatter": 1, "formatOptions": { "showIcon": true }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "nodeIdField": "status", "nodeSize": null, "staticNodeSize": 100, "colorSettings": { "nodeColorField": "status", "type": 1, "colorPalette": "default" }, "hivesMargin": 5 } }, "customWidth": "100", "name": "Overview - Hosts Count By Severity", "styleSettings": { "progressStyle": "squares" } }, { "type": 1, "content": { "json": "💡 _Click on the above tile to view more details_" }, "name": "Drill Down Info" }, { "type": 1, "content": { "json": "
" }, "conditionalVisibility": { "parameterName": "status", "comparison": "isNotEqualTo" }, "name": "Drill Down Line" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceVendor==\"Vectra Networks\" and DeviceEventClassID==\"hsc\"\r\n| extend src = coalesce(SourceHostName, SourceIP)\r\n| summarize arg_max(TimeGenerated, *) by src\r\n| extend status = case(FlexNumber1>=50 and FlexNumber2<50, \"High\",\r\n FlexNumber1>=50 and FlexNumber2>=50, \"Critical\",\r\n FlexNumber1<50 and FlexNumber2>=50, \"Medium\",\r\n FlexNumber1>0 and FlexNumber1<50 and FlexNumber2>0 and FlexNumber2<50,\"Low\",\r\n \"True\"\r\n )\r\n| where status != \"True\" and '{status}'==status\r\n| sort by FlexNumber1 desc, FlexNumber2 desc\r\n| project row_number() , status ,src,SourceIP ,DeviceCustomString1 , DeviceCustomString2 , FlexNumber1 , FlexNumber2 , DeviceCustomString4 , TimeGenerated \r\n| project-rename Sr_No = Column1, Severity=status , Hostname=src, IP_Address=SourceIP , Src_Key_Asset=DeviceCustomString1 , Dest_Key_Asset=DeviceCustomString2 , Threat=FlexNumber1 , Certainty=FlexNumber2 , Host_Details=DeviceCustomString4, Latest_Update = TimeGenerated\r\n\r\n", "size": 0, "title": "Hosts With {status} Severity", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_token", "exportFieldName": "Hostname", "exportParameterName": "hostname", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Sr_No", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "showIcon": true, "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Critical", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "green", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } }, { "columnMatch": "Hostname", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "IP_Address", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Src_Key_Asset", "formatter": 18, "formatOptions": { "showIcon": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "success", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "failed", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "Dest_Key_Asset", "formatter": 18, "formatOptions": { "showIcon": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "success", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "failed", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "Threat", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "redBright", "showIcon": true } }, { "columnMatch": "Certainty", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "blue", "showIcon": true } }, { "columnMatch": "Host_Details", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "", "showIcon": true } }, { "columnMatch": "Latest_Update", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Column1", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "src", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Row number", "formatter": 0, "formatOptions": { "showIcon": true, "aggregation": "Count" } } ], "rowLimit": 10000, "filter": true, "labelSettings": [ { "columnId": "Severity" }, { "columnId": "Hostname" }, { "columnId": "IP_Address" }, { "columnId": "Src_Key_Asset" }, { "columnId": "Dest_Key_Asset" }, { "columnId": "Threat" }, { "columnId": "Certainty" }, { "columnId": "Host_Details" }, { "columnId": "Latest_Update" } ] } }, "conditionalVisibility": { "parameterName": "status", "comparison": "isNotEqualTo" }, "name": "Overview - Hosts With selected Severity", "styleSettings": { "progressStyle": "squares" } }, { "type": 1, "content": { "json": "💡 _Click on a row in the above grid to view more details_" }, "conditionalVisibility": { "parameterName": "status", "comparison": "isNotEqualTo" }, "name": "Drill Down Info" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceVendor == \"Vectra Networks\"\r\n and DeviceEventClassID !in (\"health\", \"audit\", \"campaigns\", \"hsc\", \"asc\")\r\n| extend ExternalID = coalesce(column_ifexists(\"ExtID\", \"\"),tostring(ExternalID))\r\n| where isnotempty(ExternalID)\r\n| search kind=case_sensitive '{hostname}'\r\n| summarize arg_max(TimeGenerated, *) by ExternalID\r\n| parse AdditionalExtensions with * \"cat=\" Category \";\"*\r\n| extend src = coalesce(SourceHostName, SourceIP), dst = coalesce(DestinationHostName, DestinationIP), Category = coalesce(column_ifexists(\"DeviceEventCategory\", \"\"),Category,\"\")\r\n| sort by TimeGenerated desc, FlexNumber1 desc, FlexNumber2 desc\r\n| project row_number(), TimeGenerated, DeviceCustomString5, Category, DeviceEventClassID, src, SourceIP, dst, DestinationIP, FlexNumber1, FlexNumber2, DeviceCustomString4\r\n| project-rename Sr_No = Column1, Detection_Time = TimeGenerated, Triaged = DeviceCustomString5, Type = DeviceEventClassID , Source = src , Source_IP = SourceIP ,Destination = dst , Destination_IP = DestinationIP , Threat = FlexNumber1 , Certainty = FlexNumber2, Detection_Details = DeviceCustomString4\r\n| take 10", "size": 0, "title": "Latest 10 Detections For Host: {hostname}", "noDataMessage": "No detections found for the selected host in the specified time duration.", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_token", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Detection_Time", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Triaged", "formatter": 18, "formatOptions": { "showIcon": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "success", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "failed", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Category", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Type", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Source", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Source_IP", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Destination", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Destination_IP", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Threat", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "redBright", "showIcon": true } }, { "columnMatch": "Certainty", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "blue", "showIcon": true } }, { "columnMatch": "Detection_Details", "formatter": 7, "formatOptions": { "linkTarget": "Url", "showIcon": true } } ], "rowLimit": 10 } }, "conditionalVisibility": { "parameterName": "hostname", "comparison": "isNotEqualTo" }, "name": "Overview - Top 10 Detections For selected Host" }, { "type": 1, "content": { "json": "
" }, "conditionalVisibility": { "parameterName": "status", "comparison": "isNotEqualTo" }, "name": "Drill Down Line" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceVendor==\"Vectra Networks\" and DeviceEventClassID == \"hsc\"\r\n| extend src = coalesce(SourceHostName, SourceIP)\r\n| summarize arg_max(TimeGenerated, *) by src \r\n| sort by FlexNumber1 desc, FlexNumber2 desc\r\n| limit 10\r\n| project row_number(), src, SourceIP, FlexNumber1 , FlexNumber2, TimeGenerated\r\n| project-rename Sr_No = Column1, Source=src, Source_IP=SourceIP, Threat=FlexNumber1, Certainty=FlexNumber2, Latest_Detection = TimeGenerated", "size": 0, "showAnalytics": true, "title": "Worst Offenders", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_token", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Source", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Source_IP", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Threat", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "redBright", "showIcon": true } }, { "columnMatch": "Certainty", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "blue", "showIcon": true } }, { "columnMatch": "Latest_Detection", "formatter": 0, "formatOptions": { "showIcon": true } } ], "rowLimit": 10 } }, "customWidth": "50", "name": "Overview - Worst Offenders", "styleSettings": { "progressStyle": "squares", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceVendor==\"Vectra Networks\" and DeviceEventClassID == \"hsc\" and (DeviceCustomString1 == \"True\" or DeviceCustomString2 == \"True\")\r\n| extend src = coalesce(SourceHostName, SourceIP)\r\n| summarize arg_max(TimeGenerated, *) by src \r\n| sort by FlexNumber1 desc, FlexNumber2 desc\r\n| limit 10\r\n| project row_number(), src, SourceIP, DeviceCustomString1 , DeviceCustomString2, FlexNumber1 , FlexNumber2, TimeGenerated\r\n| project-rename Sr_No = Column1, Source=src, Source_IP=SourceIP,Src_Key_Asset=DeviceCustomString1,Des_Key_Asset=DeviceCustomString2, Threat=FlexNumber1, Certainty=FlexNumber2, Latest_Detection = TimeGenerated", "size": 0, "showAnalytics": true, "title": "Key Assets", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_token", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Source", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Source_IP", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Src_Key_Asset", "formatter": 18, "formatOptions": { "showIcon": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "success", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "failed", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "Des_Key_Asset", "formatter": 18, "formatOptions": { "showIcon": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "success", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "failed", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "Threat", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "redBright", "showIcon": true } }, { "columnMatch": "Certainty", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "blue", "showIcon": true } }, { "columnMatch": "Latest_Detection", "formatter": 0, "formatOptions": { "showIcon": true } } ], "rowLimit": 10 } }, "customWidth": "50", "name": "Overview - Key Assets", "styleSettings": { "progressStyle": "squares", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceVendor==\"Vectra Networks\" and DeviceEventClassID !in (\"health\", \"audit\", \"campaigns\", \"hsc\", \"asc\")\r\n| extend ExternalID = coalesce(column_ifexists(\"ExtID\", \"\"),tostring(ExternalID),\"\")\r\n| where isnotempty(ExternalID)\r\n| summarize Count=count() by DeviceEventClassID \r\n| top 10 by Count desc\r\n", "size": 0, "showAnalytics": true, "title": "Top 10 Detection Types", "color": "turquoise", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_token", "exportFieldName": "x", "exportParameterName": "type_token", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": {} }, "name": "Overview - Top 10 Detection Types", "styleSettings": { "progressStyle": "squares", "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on a bar in the above chart to view more details_" }, "name": "Drill Down Info" }, { "type": 1, "content": { "json": "
" }, "conditionalVisibility": { "parameterName": "type_token", "comparison": "isNotEqualTo" }, "name": "Drill Down Line" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceVendor == \"Vectra Networks\"\r\n and DeviceEventClassID !in (\"health\", \"audit\", \"campaigns\", \"hsc\", \"asc\")\r\n| extend ExternalID = coalesce(column_ifexists(\"ExtID\", \"\"),tostring(ExternalID),\"\")\r\n| where isnotempty(ExternalID)\r\n| parse AdditionalExtensions with * \"cat=\" Category \";\"*\r\n| where DeviceEventClassID == '{type_token}'\r\n| extend src = coalesce(SourceHostName, SourceIP), dst = coalesce(DestinationHostName, DestinationIP), Category = coalesce(column_ifexists(\"DeviceEventCategory\", \"\"),Category,\"\")\r\n| sort by TimeGenerated desc, FlexNumber1 desc, FlexNumber2 desc\r\n| project row_number(), DeviceCustomString5, Category, src, SourceIP, dst, DestinationIP, FlexNumber1, FlexNumber2, DeviceCustomString4, TimeGenerated\r\n| project-rename Sr_No = Column1, Triaged = DeviceCustomString5, Source = src , Source_IP = SourceIP ,Destination = dst , Destination_IP = DestinationIP , Threat = FlexNumber1 , Certainty = FlexNumber2, Detection_Details = DeviceCustomString4, Latest_Detection = TimeGenerated", "size": 0, "title": "Details For Detection Type: {type_token}", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_token", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Triaged", "formatter": 18, "formatOptions": { "showIcon": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "success", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "failed", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "Category", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Source", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Source_IP", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Destination", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Destination_IP", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Threat", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "redBright", "showIcon": true } }, { "columnMatch": "Certainty", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "blue", "showIcon": true } }, { "columnMatch": "Detection_Details", "formatter": 7, "formatOptions": { "linkTarget": "Url", "showIcon": true } }, { "columnMatch": "Latest_Detection", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Type", "formatter": 0, "formatOptions": { "showIcon": true } } ], "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "type_token", "comparison": "isNotEqualTo" }, "name": "Overview - Details For selected Detection Type", "styleSettings": { "progressStyle": "squares" } }, { "type": 1, "content": { "json": "
" }, "conditionalVisibility": { "parameterName": "type_token", "comparison": "isNotEqualTo" }, "name": "Drill Down Line" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceVendor==\"Vectra Networks\" and DeviceEventClassID !in (\"health\", \"audit\", \"campaigns\", \"hsc\", \"asc\")\r\n| extend ExternalID = coalesce(column_ifexists(\"ExtID\", \"\"),tostring(ExternalID),\"\")\r\n| where isnotempty(ExternalID)\r\n| parse AdditionalExtensions with * \"cat=\" cat \";\"*\r\n| extend cat = coalesce(\r\n column_ifexists(\"DeviceEventCategory\", \"\"),\r\n cat,\r\n \"\"\r\n )\r\n| summarize Count = count() by cat\r\n| top 10 by Count desc", "size": 0, "showAnalytics": true, "title": "Top 10 Detection Categories", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_token", "exportFieldName": "x", "exportParameterName": "category_token", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "cat", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": {} }, "name": "Overview - Top 10 Detection Categories", "styleSettings": { "progressStyle": "squares", "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on a bar in the above chart to view more details_" }, "name": "Drill Down Info" }, { "type": 1, "content": { "json": "
" }, "conditionalVisibility": { "parameterName": "category_token", "comparison": "isNotEqualTo" }, "name": "Drill Down Line" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceVendor == \"Vectra Networks\"\r\n and DeviceEventClassID !in (\"health\", \"audit\", \"campaigns\", \"hsc\", \"asc\")\r\n| extend ExternalID = coalesce(column_ifexists(\"ExtID\", \"\"),tostring(ExternalID),\"\")\r\n| where isnotempty(ExternalID)\r\n| parse AdditionalExtensions with * \"cat=\" Category \";\"*\r\n| extend Category = coalesce(column_ifexists(\"DeviceEventCategory\", \"\"),Category,\"\")\r\n| where Category == \"{category_token}\"\r\n| extend src = coalesce(SourceHostName, SourceIP), dst = coalesce(DestinationHostName, DestinationIP)\r\n| sort by TimeGenerated desc, FlexNumber1 desc, FlexNumber2 desc\r\n| project row_number(), DeviceCustomString5, DeviceEventClassID, src, SourceIP, dst, DestinationIP, FlexNumber1, FlexNumber2, DeviceCustomString4, TimeGenerated\r\n| project-rename Sr_No = Column1, Triaged = DeviceCustomString5, Type = DeviceEventClassID , Source = src , Source_IP = SourceIP ,Destination = dst , Destination_IP = DestinationIP , Threat = FlexNumber1 , Certainty = FlexNumber2, Detection_Details = DeviceCustomString4, Latest_Detection = TimeGenerated", "size": 0, "title": "Details For Detection Category: {category_token}", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_token", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Triaged", "formatter": 18, "formatOptions": { "showIcon": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "success", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "failed", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "Type", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Source", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Source_IP", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Destination", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Destination_IP", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Threat", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "redBright", "showIcon": true } }, { "columnMatch": "Certainty", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "blue", "showIcon": true } }, { "columnMatch": "Detection_Details", "formatter": 7, "formatOptions": { "linkTarget": "Url", "showIcon": true } }, { "columnMatch": "Latest_Detection", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Category", "formatter": 0, "formatOptions": { "showIcon": true } } ], "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "category_token", "comparison": "isNotEqualTo" }, "name": "Overview - Details For selected Detection Category", "styleSettings": { "progressStyle": "squares" } }, { "type": 1, "content": { "json": "
" }, "conditionalVisibility": { "parameterName": "category_token", "comparison": "isNotEqualTo" }, "name": "Drill Down Line" } ] }, "conditionalVisibilities": [ { "parameterName": "workbook-group", "comparison": "isEqualTo", "value": "detect" }, { "parameterName": "workbook", "comparison": "isEqualTo", "value": "Overview" } ], "conditionalVisibility": { "parameterName": "workbook-group", "comparison": "isEqualTo", "value": "detect" }, "name": "Cognito Detect - Overview" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "e2a6498e-1f10-4c1a-90cf-b0d97004f545", "version": "KqlParameterItem/1.0", "name": "Timerange", "type": 4, "isRequired": true, "value": { "durationMs": 86400000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "resourceType": "microsoft.insights/components" }, { "id": "1840c704-6f4b-40fd-8a54-6984bdc1d7e3", "version": "KqlParameterItem/1.0", "name": "severity_token", "label": "Severity", "type": 2, "isRequired": true, "query": "datatable (status:string) [\"All\"]\r\n|union\r\n(\r\nCommonSecurityLog\r\n| where DeviceEventClassID == \"hsc\" and DeviceVendor == \"Vectra Networks\"\r\n| extend src = coalesce(SourceHostName, SourceIP)\r\n| summarize arg_max(TimeGenerated, *) by src\r\n| extend status = case(FlexNumber1>=50 and FlexNumber2<50, \"High\",\r\n FlexNumber1>=50 and FlexNumber2>=50, \"Critical\",\r\n FlexNumber1<50 and FlexNumber2>=50, \"Medium\",\r\n FlexNumber1>0 and FlexNumber1<50 and FlexNumber2>0 and FlexNumber2<50,\"Low\",\r\n \"pass\"\r\n )\r\n| where status != \"pass\"\r\n| distinct status\r\n)", "value": "All", "typeSettings": { "additionalResourceOptions": [] }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timerange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Hosts - Parameters" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let token = \"{severity_token}\";\r\nCommonSecurityLog\r\n| where DeviceEventClassID == \"hsc\" and DeviceVendor == \"Vectra Networks\"\r\n| extend src = coalesce(SourceHostName, SourceIP)\r\n| summarize arg_max(TimeGenerated, *) by src\r\n| extend status = case(FlexNumber1>=50 and FlexNumber2<50, \"High\",\r\n FlexNumber1>=50 and FlexNumber2>=50, \"Critical\",\r\n FlexNumber1<50 and FlexNumber2>=50, \"Medium\",\r\n FlexNumber1>0 and FlexNumber1<50 and FlexNumber2>0 and FlexNumber2<50,\"Low\",\r\n \"pass\"\r\n )\r\n| where status != \"pass\"\r\n| where case(token == \"All\", status!=\"All\", status==token)\r\n| sort by FlexNumber1 desc, FlexNumber2 desc,TimeGenerated desc\r\n| project row_number(), status , SourceHostName , SourceIP , DeviceCustomString1 , DeviceCustomString2 , FlexNumber1 , FlexNumber2 , DeviceCustomString4 , TimeGenerated\r\n| project-rename Sr_No = Column1, Severity = status ,Hostname= SourceHostName , Source_IP = SourceIP , Src_Key_Asset = DeviceCustomString1 ,Dest_Key_Asset = DeviceCustomString2 , Threat = FlexNumber1 , Certainty = FlexNumber2 , Host_Details = DeviceCustomString4, Latest_Update = TimeGenerated\r\n", "size": 1, "showAnalytics": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timerange", "exportFieldName": "Hostname", "exportParameterName": "hostname", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "showIcon": true, "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Low", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Critical", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "All", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "Hostname", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Source_IP", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Src_Key_Asset", "formatter": 18, "formatOptions": { "showIcon": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "success", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "failed", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "Dest_Key_Asset", "formatter": 18, "formatOptions": { "showIcon": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "success", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "failed", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "Threat", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "redBright", "showIcon": true } }, { "columnMatch": "Certainty", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "blue", "showIcon": true } }, { "columnMatch": "Host_Details", "formatter": 7, "formatOptions": { "linkTarget": "Url", "showIcon": true } }, { "columnMatch": "Latest_Update", "formatter": 0, "formatOptions": { "showIcon": true } } ], "rowLimit": 10000, "filter": true } }, "name": "Hosts - Details" }, { "type": 1, "content": { "json": "💡 _Click on a row in the above grid to view more details_" }, "name": "Drill Down Info" }, { "type": 1, "content": { "json": "
" }, "conditionalVisibility": { "parameterName": "hostname", "comparison": "isNotEqualTo" }, "name": "Drill Down Line" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceEventClassID == \"hsc\" and DeviceVendor == \"Vectra Networks\"\r\n| extend src = coalesce(SourceHostName, SourceIP)\r\n| where src=='{hostname}'\r\n| summarize arg_max(TimeGenerated, FlexNumber1, FlexNumber2) by TimeGenerated=bin(TimeGenerated,10m)\r\n| project-rename Threat=FlexNumber1, Certainty=FlexNumber2\r\n", "size": 0, "aggregation": 5, "title": "Threat And Certainty Over Time For Host: {hostname}", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timerange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "linechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Threat", "label": "Threat", "color": "redBright" }, { "seriesName": "Certainty", "label": "Certainty", "color": "blue" } ] } }, "conditionalVisibility": { "parameterName": "hostname", "comparison": "isNotEqualTo" }, "name": "Hosts - Threat And Certainty Over Time For selected Host" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceVendor == \"Vectra Networks\"\r\n and DeviceEventClassID !in (\"health\", \"audit\", \"campaigns\", \"hsc\", \"asc\")\r\n and (isnotnull(ExternalID) or isnotnull(ExtID))\r\n| parse-where AdditionalExtensions with * \"cat=\" Category \";\"*\r\n| extend src = coalesce(SourceHostName, SourceIP), dst = coalesce(DestinationHostName, DestinationIP), Category = coalesce(Category, DeviceEventCategory), ExternalID = coalesce(ExternalID,ExtID)\r\n| search kind=case_sensitive '{hostname}'\r\n| summarize arg_max(TimeGenerated, *) by ExternalID\r\n| sort by FlexNumber1 desc, FlexNumber2 desc\r\n| project row_number(), TimeGenerated, DeviceCustomString5, Category, DeviceEventClassID, src, SourceIP, dst, DestinationIP, FlexNumber1, FlexNumber2, DeviceCustomString4\r\n| project-rename Sr_No = Column1, Detection_Time = TimeGenerated, Triaged = DeviceCustomString5, Type = DeviceEventClassID , Source = src , Source_IP = SourceIP ,Destination = dst , Destination_IP = DestinationIP , Threat = FlexNumber1 , Certainty = FlexNumber2, Detection_Details = DeviceCustomString4", "size": 0, "title": "Detection Details For Host: {hostname}", "noDataMessage": "No detections found for the selected host in the specified time duration.", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timerange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Detection_Time", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Triaged", "formatter": 18, "formatOptions": { "showIcon": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "success", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "failed", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "Category", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Type", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Source", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Source_IP", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Destination", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Destination_IP", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Threat", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "redBright", "showIcon": true } }, { "columnMatch": "Certainty", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "blue", "showIcon": true } }, { "columnMatch": "Detection_Details", "formatter": 7, "formatOptions": { "linkTarget": "Url", "showIcon": true } } ], "rowLimit": 10000 } }, "conditionalVisibility": { "parameterName": "hostname", "comparison": "isNotEqualTo" }, "name": "Hosts - Detection Details For selected Host" }, { "type": 1, "content": { "json": "
" }, "conditionalVisibility": { "parameterName": "hostname", "comparison": "isNotEqualTo" }, "name": "Drill Down Line" } ] }, "conditionalVisibilities": [ { "parameterName": "workbook-group", "comparison": "isEqualTo", "value": "detect" }, { "parameterName": "workbook", "comparison": "isEqualTo", "value": "Hosts" } ], "conditionalVisibility": { "parameterName": "workbook-group", "comparison": "isEqualTo", "value": "detect" }, "name": "Cognito Detect - Hosts" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "8641c210-ae59-4759-be51-6c92fa8e4d4e", "version": "KqlParameterItem/1.0", "name": "time_token", "label": "Timerange", "type": 4, "isRequired": true, "value": { "durationMs": 86400000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "resourceType": "microsoft.insights/components" }, { "id": "f27ef7a3-1638-4b26-8027-7bc5ca4948b4", "version": "KqlParameterItem/1.0", "name": "severity_token", "label": "Severity", "type": 2, "isRequired": true, "query": "datatable (status:string) [\"All\"]\r\n|union\r\n(\r\nCommonSecurityLog\r\n| where DeviceVendor == \"Vectra Networks\" and DeviceEventClassID == \"asc\" and isnotnull(FlexNumber1) and isnotnull(FlexNumber2)\r\n| extend ExternalID = coalesce(column_ifexists(\"ExtID\", \"\"),tostring(ExternalID),\"\")\r\n| where isnotempty(ExternalID)\r\n| summarize arg_max(TimeGenerated, *) by ExternalID\r\n| extend status = case(FlexNumber1>=50 and FlexNumber2<50, \"High\",\r\n FlexNumber1>=50 and FlexNumber2>=50, \"Critical\",\r\n FlexNumber1<50 and FlexNumber2>=50, \"Medium\",\r\n FlexNumber1>0 and FlexNumber1<50 and FlexNumber2>0 and FlexNumber2<50,\"Low\",\r\n \"pass\"\r\n )\r\n| where status != \"pass\"\r\n| distinct status\r\n)", "value": "All", "typeSettings": { "additionalResourceOptions": [] }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_token", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Accounts - Parameters" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceVendor==\"Vectra Networks\" and DeviceEventClassID==\"asc\" and isnotnull(FlexNumber1) and isnotnull(FlexNumber2)\r\n| extend ExternalID = coalesce(column_ifexists(\"ExtID\", \"\"),tostring(ExternalID),\"\")\r\n| where isnotempty(ExternalID)\r\n| summarize arg_max(TimeGenerated, *) by ExternalID\r\n| extend status = case(FlexNumber1>=50 and FlexNumber2<50, \"High\",FlexNumber1>=50 and FlexNumber2>=50, \"Critical\",FlexNumber1<50 and FlexNumber2>=50, \"Medium\",FlexNumber1>0 and FlexNumber1<50 and FlexNumber2>0 and FlexNumber2<50,\"Low\",\"True\")\r\n| extend saccount = extract(\"saccount=(.+?);\", 1, AdditionalExtensions)\r\n | where status != \"True\"\r\n| where case(\"{severity_token}\" == \"All\", status!=\"All\", status==\"{severity_token}\")\r\n| sort by FlexNumber1 desc, FlexNumber2 desc\r\n| project row_number(), status, saccount, FlexNumber1, FlexNumber2, DeviceCustomString4, TimeGenerated\r\n| project-rename Sr_No = Column1, Severity=status, Account_Name=saccount, Threat=FlexNumber1, Certainty=FlexNumber2, Account_Details=DeviceCustomString4, Latest_Update = TimeGenerated", "size": 0, "showAnalytics": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_token", "exportFieldName": "Account_Name", "exportParameterName": "account_name", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "showIcon": true, "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Critical", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "green", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] } }, { "columnMatch": "Account_Name", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Threat", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "redBright", "showIcon": true } }, { "columnMatch": "Certainty", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "blue", "showIcon": true } }, { "columnMatch": "Account_Details", "formatter": 7, "formatOptions": { "linkTarget": "Url", "showIcon": true } }, { "columnMatch": "Latest_Update", "formatter": 0, "formatOptions": { "showIcon": true } } ], "rowLimit": 10000, "filter": true } }, "name": "Accounts - Details" }, { "type": 1, "content": { "json": "💡 _Click on a row in the above grid to view more details_" }, "name": "Drill Down Info" }, { "type": 1, "content": { "json": "
" }, "conditionalVisibility": { "parameterName": "account_name", "comparison": "isNotEqualTo" }, "name": "Drill Down Line" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceVendor == \"Vectra Networks\" and DeviceEventClassID !in (\"health\", \"audit\", \"campaigns\", \"hsc\", \"asc\")\r\n| extend ExternalID = coalesce(column_ifexists(\"ExtID\", \"\"),tostring(ExternalID),\"\")\r\n| where isnotempty(ExternalID)\r\n| parse AdditionalExtensions with * \"cat=\" Category \";\"*\r\n| parse-where AdditionalExtensions with * \"account=\" account \";\"*\r\n| extend Category = coalesce(\r\n column_ifexists(\"DeviceEventCategory\", \"\"),\r\n Category,\r\n \"\"\r\n )\r\n| where account == '{account_name}'\r\n| summarize count() by Category, TimeGenerated", "size": 0, "showAnnotations": true, "title": "Detection Categories Over Time For Account: {account_name}", "noDataMessage": "No detections found for the selected Account in the specified time duration.", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_token", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart" }, "conditionalVisibility": { "parameterName": "account_name", "comparison": "isNotEqualTo" }, "name": "Accounts - Detection Categories over Time for selected Account" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceVendor == \"Vectra Networks\" and DeviceEventClassID !in (\"health\", \"audit\", \"campaigns\", \"hsc\", \"asc\") \r\n| extend ExternalID = coalesce(column_ifexists(\"ExtID\", \"\"),tostring(ExternalID),\"\")\r\n| where isnotempty(ExternalID)\r\n| parse AdditionalExtensions with * \"cat=\" Category \";\"*\r\n| parse-where AdditionalExtensions with * \"account=\" account \";\"*\r\n| extend Category = coalesce(column_ifexists(\"DeviceEventCategory\", \"\"),Category,\"\")\r\n| where account == '{account_name}'\r\n| sort by TimeGenerated desc, FlexNumber1 desc, FlexNumber2 desc\r\n| project row_number(), TimeGenerated, DeviceCustomString5, Category, DeviceEventClassID, account, FlexNumber1, FlexNumber2, DeviceCustomString4\r\n| project-rename Sr_No = Column1, Detection_Time = TimeGenerated, Triaged = DeviceCustomString5, Type = DeviceEventClassID , Account = account , Threat = FlexNumber1 , Certainty = FlexNumber2, Detection_Details = DeviceCustomString4", "size": 0, "title": "Detections Details For Account: {account_name}", "noDataMessage": "No detections found for the selected Account in the specified time duration.", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "time_token", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Triaged", "formatter": 18, "formatOptions": { "showIcon": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "success", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "failed", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "Category", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Type", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Source", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Source_IP", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Destination", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Destination_IP", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Threat", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "redBright", "showIcon": true } }, { "columnMatch": "Certainty", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "blue", "showIcon": true } }, { "columnMatch": "Detection_Details", "formatter": 7, "formatOptions": { "linkTarget": "Url", "showIcon": true } }, { "columnMatch": "Latest_Detection", "formatter": 0, "formatOptions": { "showIcon": true } } ], "rowLimit": 10000 } }, "conditionalVisibility": { "parameterName": "account_name", "comparison": "isNotEqualTo" }, "name": "Accounts - Detection Details for selected Account" }, { "type": 1, "content": { "json": "
" }, "conditionalVisibility": { "parameterName": "account_name", "comparison": "isNotEqualTo" }, "name": "Drill Down Line" } ] }, "conditionalVisibilities": [ { "parameterName": "workbook", "comparison": "isEqualTo", "value": "Accounts" }, { "parameterName": "workbook-group", "comparison": "isEqualTo", "value": "detect" } ], "conditionalVisibility": { "parameterName": "workbook", "comparison": "isEqualTo", "value": "Accounts" }, "name": "Cognito Detect - Accounts" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "4464cdd2-3612-4e5c-ba5e-791de3647382", "version": "KqlParameterItem/1.0", "name": "Time_Range", "label": "Timerange", "type": 4, "isRequired": true, "value": { "durationMs": 86400000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "resourceType": "microsoft.insights/components" }, { "id": "06436e5d-7593-4db7-9b38-cd148e7ef014", "version": "KqlParameterItem/1.0", "name": "category_token", "label": "Detection Categories", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "CommonSecurityLog\r\n| where DeviceVendor == \"Vectra Networks\"\r\n| where DeviceEventClassID !in~ (\"health\", \"audit\", \"campaigns\", \"hsc\", \"asc\")\r\n| extend ExternalID = coalesce(column_ifexists(\"ExtID\", \"\"),tostring(ExternalID),\"\")\r\n| where isnotempty(ExternalID)\r\n| parse AdditionalExtensions with * \"cat=\" Category \";\"*\r\n| extend Category = coalesce(column_ifexists(\"DeviceEventCategory\", \"\"),Category,\"\")\r\n| distinct Category\r\n", "value": [ "value::all" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "" }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Time_Range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "dd678237-f94c-4041-acca-99d5213042db", "version": "KqlParameterItem/1.0", "name": "type_token", "label": "Type", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "CommonSecurityLog\r\n| where DeviceVendor == \"Vectra Networks\"\r\n| where DeviceEventClassID !in~ (\"health\", \"audit\", \"campaigns\", \"hsc\", \"asc\")\r\n| extend ExternalID = coalesce(column_ifexists(\"ExtID\", \"\"),tostring(ExternalID),\"\")\r\n| where isnotempty(ExternalID)\r\n| parse-where AdditionalExtensions with * \"cat=\" Category \";\"*\r\n| extend Category = coalesce(column_ifexists(\"DeviceEventCategory\", \"\"),Category,\"\")\r\n| where Category in ({category_token})\r\n| distinct DeviceEventClassID\r\n", "value": [ "value::all" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "" }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Time_Range", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Detections - Parameters" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceVendor == \"Vectra Networks\"\r\n and DeviceEventClassID !in (\"health\", \"audit\", \"campaigns\", \"hsc\", \"asc\")\r\n| extend ExternalID = coalesce(column_ifexists(\"ExtID\", \"\"),tostring(ExternalID),\"\")\r\n| where isnotempty(ExternalID)\r\n| parse AdditionalExtensions with * \"cat=\" Category \";\"*\r\n| extend Category = coalesce(\r\n column_ifexists(\"DeviceEventCategory\", \"\"),\r\n Category,\r\n \"\"\r\n )\r\n| where Category in ({category_token}) \r\n and DeviceEventClassID in ({type_token})\r\n| summarize count() by Category, TimeGenerated", "size": 0, "showAnnotations": true, "showAnalytics": true, "title": "Detection Categories Over Time", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Time_Range", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "chartSettings": { "xAxis": "TimeGenerated", "ySettings": { "unit": 17, "min": null, "max": null } } }, "name": "Detections - Detection Categories over Time" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceVendor == \"Vectra Networks\"\r\n and DeviceEventClassID !in (\"health\", \"audit\", \"campaigns\", \"hsc\", \"asc\")\r\n| extend ExternalID = coalesce(column_ifexists(\"ExtID\", \"\"),tostring(ExternalID),\"\")\r\n| where isnotempty(ExternalID)\r\n| parse-where AdditionalExtensions with * \"cat=\" Category \";\"*\r\n| extend Category = coalesce(\r\n column_ifexists(\"DeviceEventCategory\", \"\"),\r\n Category,\r\n \"\"\r\n )\r\n| where Category in ({category_token}) \r\n and DeviceEventClassID in ({type_token})\r\n| extend src = coalesce(SourceHostName, SourceIP), dst = coalesce(DestinationHostName, DestinationIP)\r\n| sort by TimeGenerated desc, FlexNumber1 desc, FlexNumber2 desc\r\n| project row_number(), TimeGenerated, ExternalID, DeviceCustomString5, Category, DeviceEventClassID, src, SourceIP, dst, DestinationIP, FlexNumber1, FlexNumber2, DeviceCustomString4\r\n| project-rename Sr_No = Column1,Detection_Time = TimeGenerated, External_ID = ExternalID, Triaged = DeviceCustomString5, Type = DeviceEventClassID , Source = src , Source_IP = SourceIP ,Destination = dst , Destination_IP = DestinationIP , Threat = FlexNumber1 , Certainty = FlexNumber2, Detection_Details = DeviceCustomString4", "size": 0, "aggregation": 3, "showAnalytics": true, "title": "Detection Details", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Time_Range", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Triaged", "formatter": 18, "formatOptions": { "showIcon": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "success", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "failed", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "Category", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Type", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Source", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Source_IP", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Destination", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Destination_IP", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Threat", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "redBright", "showIcon": true } }, { "columnMatch": "Certainty", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "blue", "showIcon": true } }, { "columnMatch": "Detection_Details", "formatter": 7, "formatOptions": { "linkTarget": "Url", "showIcon": true } }, { "columnMatch": "Latest_Detection", "formatter": 0, "formatOptions": { "showIcon": true } } ], "rowLimit": 10000, "filter": true }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Triaged", "formatter": 1 }, "leftContent": { "columnMatch": "Threat", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "name": "Detections - Detection Details" } ] }, "conditionalVisibilities": [ { "parameterName": "workbook-group", "comparison": "isEqualTo", "value": "detect" }, { "parameterName": "workbook", "comparison": "isEqualTo", "value": "Detections" } ], "conditionalVisibility": { "parameterName": "workbook-group", "comparison": "isEqualTo", "value": "detect" }, "name": "Cognito Detect - Detections" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "02b1f3a8-4aa8-4a98-9725-0d960b4fecbf", "version": "KqlParameterItem/1.0", "name": "timerange", "label": "Timerange", "type": 4, "isRequired": true, "value": { "durationMs": 86400000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "resourceType": "microsoft.insights/components" }, { "id": "799a853f-1f98-477e-b3bf-66cba445dcf5", "version": "KqlParameterItem/1.0", "name": "campaign_token", "label": "Campaign ID", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "CommonSecurityLog\r\n| where DeviceVendor == \"Vectra Networks\" and DeviceEventClassID == \"campaigns\"\r\n| distinct Activity", "value": [ "value::all" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ] }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "timerange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "3dc8536b-3619-4418-862b-023d05ae58bd", "version": "KqlParameterItem/1.0", "name": "type_token", "label": "Type", "type": 2, "isRequired": true, "query": "datatable (reason:string) [\"All\"]\r\n| union\r\n(\r\nCommonSecurityLog\r\n| where DeviceVendor == \"Vectra Networks\" and DeviceEventClassID == \"campaigns\"\r\n| parse AdditionalExtensions with * \"reason=\"reason\r\n| extend reason = coalesce(column_ifexists(\"Reason\", \"\"),reason,\"\")\r\n| where Activity in ({campaign_token})\r\n| distinct reason\r\n)", "value": "All", "typeSettings": { "additionalResourceOptions": [] }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "timerange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Campaigns - Parameters" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceVendor == \"Vectra Networks\" and DeviceEventClassID == \"campaigns\"\r\n| parse AdditionalExtensions with * \"reason=\"reason\r\n| extend reason = coalesce(\r\n column_ifexists(\"Reason\", \"\"),\r\n reason,\r\n \"\"\r\n )\r\n| where Activity in ({campaign_token})\r\n| where case(\"{type_token}\" == \"All\", reason != \"All\", reason == \"{type_token}\")\r\n| extend src = coalesce(SourceHostName, SourceIP) , dest = coalesce(DestinationHostName, DestinationIP)\r\n| summarize Count = count() by Activity\r\n| top 10 by Count desc", "size": 0, "showAnalytics": true, "title": "Top 10 Campaigns", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "timerange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "Activity", "ySettings": { "unit": 17, "min": null, "max": null } } }, "name": "Campaigns - Top 10 Campaigns", "styleSettings": { "progressStyle": "squares" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceVendor == \"Vectra Networks\" and DeviceEventClassID == \"campaigns\"\r\n| parse AdditionalExtensions with * \"reason=\"reason\r\n| extend reason = coalesce(\r\n column_ifexists(\"Reason\", \"\"),\r\n reason,\r\n \"\"\r\n )\r\n| where Activity in ({campaign_token})\r\n| where case(\"{type_token}\" == \"All\", reason != \"All\", reason == \"{type_token}\")\r\n| extend src = coalesce(SourceHostName, SourceIP) , dest = coalesce(DestinationHostName, DestinationIP)\r\n| sort by TimeGenerated desc\r\n| project row_number(), TimeGenerated , Activity , DeviceCustomString4 , DeviceAction , src , SourceIP , dest , DestinationIP , reason, DeviceCustomString6\r\n| project-rename Sr_No = Column1, Time_Generated = TimeGenerated, Campaign_ID = Activity, Campaign_URL = DeviceCustomString4, Action = DeviceAction, Hostname = src, Source_IP = SourceIP, Destination = dest, Destination_IP = DestinationIP, Type = reason, Detection_ID = DeviceCustomString6", "size": 0, "showAnalytics": true, "title": "Campaign Details", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "timerange", "exportFieldName": "Hostname", "exportParameterName": "search_detections", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Time_Generated", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Campaign_ID", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Campaign_URL", "formatter": 7, "formatOptions": { "linkTarget": "Url", "showIcon": true } }, { "columnMatch": "Action", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Hostname", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Source_IP", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Destination", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Destination_IP", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Type", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Detection_ID", "formatter": 0, "formatOptions": { "showIcon": true } } ], "rowLimit": 10000, "filter": true } }, "name": "Campaigns - Campaign Details", "styleSettings": { "progressStyle": "squares" } }, { "type": 1, "content": { "json": "💡 _Click on a row in the above grid to view more details_" }, "name": "Drill Down Info" }, { "type": 1, "content": { "json": "
" }, "conditionalVisibility": { "parameterName": "search_detections", "comparison": "isNotEqualTo" }, "name": "Drill Down Line" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceVendor == \"Vectra Networks\"\r\n and DeviceEventClassID !in (\"health\", \"audit\", \"campaigns\", \"hsc\", \"asc\")\r\n| parse AdditionalExtensions with * \"cat=\" Category \";\"*\r\n| extend Category = coalesce(\r\n column_ifexists(\"DeviceEventCategory\", \"\"),\r\n Category,\r\n \"\"\r\n )\r\n| search kind=case_sensitive \"{search_detections}\"\r\n| summarize count() by Category, TimeGenerated", "size": 0, "title": "Detection Categories Over Time for Host: {search_detections}", "noDataMessage": "No detections found for the selected host in the specified time duration.", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "timerange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart", "chartSettings": { "xAxis": "TimeGenerated" } }, "conditionalVisibility": { "parameterName": "search_detections", "comparison": "isNotEqualTo" }, "name": "Campaigns - Detection Categories over Time for selected Host" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceVendor == \"Vectra Networks\"\r\n and DeviceEventClassID !in (\"health\", \"audit\", \"campaigns\", \"hsc\", \"asc\")\r\n| extend ExternalID = coalesce(column_ifexists(\"ExtID\", \"\"),tostring(ExternalID),\"\")\r\n| where isnotempty(ExternalID)\r\n| parse AdditionalExtensions with * \"cat=\" Category \";\"*\r\n| extend Category = coalesce(\r\n column_ifexists(\"DeviceEventCategory\", \"\"),\r\n Category,\r\n \"\"\r\n )\r\n| search kind=case_sensitive \"{search_detections}\"\r\n| extend src = coalesce(SourceHostName, SourceIP), dst = coalesce(DestinationHostName, DestinationIP)\r\n| sort by TimeGenerated desc, FlexNumber1 desc, FlexNumber2 desc\r\n| project row_number(), TimeGenerated, DeviceCustomString5, Category, DeviceEventClassID, src, SourceIP, dst, DestinationIP, FlexNumber1, FlexNumber2, DeviceCustomString4\r\n| project-rename Sr_No = Column1,Detection_Time = TimeGenerated, Triaged = DeviceCustomString5, Type = DeviceEventClassID , Source = src , Source_IP = SourceIP ,Destination = dst , Destination_IP = DestinationIP , Threat = FlexNumber1 , Certainty = FlexNumber2, Detection_Details = DeviceCustomString4", "size": 0, "title": "Detection Details For Host: {search_detections}", "noDataMessage": "No detections found for the selected host in the specified time duration.", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "timerange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Detection_Time", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Triaged", "formatter": 18, "formatOptions": { "showIcon": true, "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "True", "representation": "success", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "False", "representation": "failed", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "Blank", "text": "{0}{1}" } ] } }, { "columnMatch": "Category", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Type", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Source", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Source_IP", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Destination", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Destination_IP", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Threat", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "redBright", "showIcon": true } }, { "columnMatch": "Certainty", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "blue", "showIcon": true } }, { "columnMatch": "Detection_Details", "formatter": 7, "formatOptions": { "linkTarget": "Url", "showIcon": true } } ], "rowLimit": 10000 } }, "conditionalVisibility": { "parameterName": "search_detections", "comparison": "isNotEqualTo" }, "name": "Campaigns - Detection details for selected Host", "styleSettings": { "progressStyle": "squares" } }, { "type": 1, "content": { "json": "
" }, "conditionalVisibility": { "parameterName": "search_detections", "comparison": "isNotEqualTo" }, "name": "Drill Down Line" } ] }, "conditionalVisibilities": [ { "parameterName": "workbook-group", "comparison": "isEqualTo", "value": "detect" }, { "parameterName": "workbook", "comparison": "isEqualTo", "value": "Campaigns" } ], "conditionalVisibility": { "parameterName": "workbook-group", "comparison": "isEqualTo", "value": "detect" }, "name": "Cognito Detect - Campaigns" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "01f96cf3-5a76-4528-a6e4-0dd997b074f0", "version": "KqlParameterItem/1.0", "name": "Timerange", "type": 4, "isRequired": true, "value": { "durationMs": 86400000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "resourceType": "microsoft.insights/components" }, { "id": "b015e943-3b18-4fc2-b048-408104856b8a", "version": "KqlParameterItem/1.0", "name": "result_token", "label": "Result", "type": 2, "isRequired": true, "query": "datatable (Result:string) [\"All\"]\r\n| union\r\n(\r\nCommonSecurityLog\r\n| where DeviceVendor == \"Vectra Networks\"\r\n| where DeviceEventClassID == \"health\"\r\n| parse AdditionalExtensions with * \"outcome=\"Result\r\n| extend Result = coalesce(column_ifexists(\"EventOutcome\", \"\"),Result,\"\")\r\n| summarize by Result\r\n) \r\n", "value": "All", "typeSettings": { "additionalResourceOptions": [] }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timerange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Health - Parameters" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceVendor == \"Vectra Networks\"\r\n| where DeviceEventClassID == \"health\"\r\n| parse AdditionalExtensions with * \"outcome=\"outcome\r\n| extend outcome = coalesce(column_ifexists(\"EventOutcome\", \"\"),outcome,\"\")\r\n| where case(\"{result_token:value}\" == \"All\", outcome != \"All\", outcome==\"{result_token:value}\")\r\n| sort by TimeGenerated desc\r\n| project row_number(), TimeGenerated ,outcome,Message\r\n| project-rename Sr_No = Column1,Time_Generated = TimeGenerated, Activity = Message,Result = outcome\r\n", "size": 0, "showAnalytics": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timerange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Sr_No", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Time_Generated", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Result", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "Activity", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "TimeGenerated", "formatter": 0, "formatOptions": { "showIcon": true } }, { "columnMatch": "activity", "formatter": 0, "formatOptions": { "showIcon": true } } ], "rowLimit": 10000, "filter": true, "labelSettings": [ { "columnId": "Sr_No" }, { "columnId": "Time_Generated" }, { "columnId": "Result" }, { "columnId": "Activity" } ] } }, "customWidth": "100", "name": "Health - Details" } ] }, "conditionalVisibility": { "parameterName": "workbook-group", "comparison": "isEqualTo", "value": "health" }, "name": "Cognito Health" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "b0cf3947-fa7b-438f-a994-40fc131f7350", "version": "KqlParameterItem/1.0", "name": "Timerange", "type": 4, "isRequired": true, "value": { "durationMs": 86400000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "resourceType": "microsoft.insights/components" }, { "id": "d1edf9eb-ef80-4bc2-84c6-d7a34487aafb", "version": "KqlParameterItem/1.0", "name": "user_token", "label": "User", "type": 2, "isRequired": true, "query": "datatable (SourceUserName:string) [\"All\"]\r\n| union\r\n(\r\nCommonSecurityLog\r\n| where DeviceVendor == \"Vectra Networks\" and DeviceEventClassID == \"audit\"\r\n| extend SourceUserName = coalesce(SourceUserName, \"Unknown\")\r\n| distinct SourceUserName\r\n)", "value": "All", "typeSettings": { "additionalResourceOptions": [] }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timerange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "7ffa2e20-6a43-4afb-b38f-7db9816057ad", "version": "KqlParameterItem/1.0", "name": "result_token", "label": "Result", "type": 2, "isRequired": true, "query": "datatable (Result:string) [\"All\"]\r\n| union\r\n(\r\nCommonSecurityLog\r\n| where DeviceVendor == \"Vectra Networks\" and DeviceEventClassID == \"audit\"\r\n| parse AdditionalExtensions with * \"outcome=\"Result\r\n| extend Result = coalesce(column_ifexists(\"EventOutcome\", \"\"),Result,\"\")\r\n| where case(\"{user_token}\" == \"All\", SourceUserName != \"All\", \"{user_token}\" == \"Unknown\", SourceUserName == \"\", SourceUserName == \"{user_token}\")\r\n| distinct Result\r\n)", "value": "All", "typeSettings": { "additionalResourceOptions": [] }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timerange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Audit - Parameters" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceEventClassID == \"audit\" and DeviceVendor == \"Vectra Networks\"\r\n| parse AdditionalExtensions with * \"outcome=\"outcome\r\n| extend outcome = coalesce(column_ifexists(\"EventOutcome\", \"\"),outcome,\"\")\r\n| where case(\"{user_token}\" == \"All\", SourceUserName != \"All\", \"{user_token}\" == \"Unknown\", SourceUserName == \"\", SourceUserName == \"{user_token}\") \r\n and case(\"{result_token}\" == \"All\", outcome != \"All\", outcome == \"{result_token}\")\r\n| sort by TimeGenerated desc\r\n| project row_number(), TimeGenerated,SourceUserName,SourceUserPrivileges,Message,outcome\r\n| project-rename Sr_No= Column1,Time_Generated = TimeGenerated, User=SourceUserName, Role=SourceUserPrivileges, Activity=Message, Result=outcome", "size": 0, "showAnalytics": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timerange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "Audit - Details" } ] }, "conditionalVisibility": { "parameterName": "workbook-group", "comparison": "isEqualTo", "value": "audit" }, "name": "Cognito Audit" }, { "type": 1, "content": { "json": "📝 ***Refresh the web page to fetch details of recently collected events***" }, "name": "Info Message" } ], "fromTemplateId": "sentinel-AIVectraDetect", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }