{ "version": "Notebook/1.0", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Anomaly Summary", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident \r\n| mv-expand AlertIds\r\n| extend AlertIds = tostring(AlertIds)\r\n| join \r\n(\r\n SecurityAlert\r\n) on $left.AlertIds == $right.SystemAlertId\r\n| where AlertType == '8ecf8077-cf51-4820-aadd-14040956f35d_212ef723-bb93-4450-8ef5-166c43dc6e57'\r\n| summarize by ProviderIncidentId, TenantId\r\n| count", "size": 4, "title": "Incidents with Anomalies", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Count", "formatter": 3, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "customWidth": "20", "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Anomalies\r\n| count", "size": 4, "title": "Anomalies", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Count", "formatter": 3, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "customWidth": "20", "name": "Anomalies" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Anomalies\r\n| where tostring(Entities) contains '\"Type\":\"host\"'\r\n| count", "size": 4, "title": "Anomalies by Host", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Count", "formatter": 3, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "customWidth": "20", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Anomalies\r\n| where tostring(Entities) contains '\"Type\":\"account\"'\r\n| count", "size": 4, "title": "Anomalies by Account", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Count", "formatter": 3, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "customWidth": "20", "name": "query - 2 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Anomalies\r\n| where tostring(Entities) contains '\"Type\":\"ip\"'\r\n| count", "size": 4, "title": "Anomalies by IP", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "leftContent": { "columnMatch": "Count", "formatter": 3, "formatOptions": { "palette": "blue" } }, "showBorder": false } }, "customWidth": "20", "name": "query - 2 - Copy - Copy" } ] }, "name": "Anomaly Summary" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let incidentIdList = SecurityIncident \r\n| mv-expand AlertIds\r\n| extend AlertIds = tostring(AlertIds)\r\n| join SecurityAlert on $left.AlertIds == $right.SystemAlertId\r\n| where AlertType == '8ecf8077-cf51-4820-aadd-14040956f35d_212ef723-bb93-4450-8ef5-166c43dc6e57'\r\n| summarize by ProviderIncidentId, TenantId;\r\nSecurityIncident\r\n| join kind=innerunique incidentIdList on ProviderIncidentId, TenantId\r\n| project-away ProviderIncidentId1, TenantId1\r\n| project Title, IncidentUrl, TimeGenerated, IncidentName, Description, Severity, Status, Classification, ClassificationComment, ClassificationReason, Owner, ProviderName, ProviderIncidentId, FirstActivityTime, LastActivityTime, FirstModifiedTime, LastModifiedTime, CreatedTime, ClosedTime, IncidentNumber, RelatedAnalyticRuleIds, AlertIds, BookmarkIds, Comments, Labels, AdditionalData, ModifiedBy, SourceSystem\r\n| order by TimeGenerated desc", "size": 0, "title": "Incidents", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "sortBy": [ { "itemKey": "IncidentName", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "IncidentName", "sortOrder": 2 } ] }, "customWidth": "50", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Anomalies \r\n| project TimeGenerated, Id, AnomalyTemplateName, AnomalyTemplateId, AnomalyTemplateVersion, WorkspaceId, VendorName, RuleId, RuleStatus, RuleName, RuleConfigVersion, Score, Description, StartTime, EndTime, ExtendedLinks, Tactics, Techniques, UserName, UserPrincipalName, SourceIpAddress, SourceLocation, SourceDevice, DestinationIpAddress, DestinationLocation, DestinationDevice, ActivityInsights, DeviceInsights, UserInsights, AnomalyReasons, Entities, ExtendedProperties, AnomalyDetails, SourceSystem \r\n| order by TimeGenerated desc", "size": 0, "title": "Latest Anomalies (Last 7 Days)", "timeContext": { "durationMs": 604800000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "Latest Anomalies" } ] }, "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "Anomalies\r\n| extend AnomalyType = AnomalyTemplateName\r\n| summarize count() by AnomalyType\r\n| sort by count_ desc", "size": 0, "timeContext": { "durationMs": 2592000000 }, "exportFieldName": "AnomalyType", "exportParameterName": "AnomalyType", "exportDefaultValue": "*", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true } }, "customWidth": "25", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let AnomalyTypeString_ = trim('\"', '{AnomalyType}');\r\nAnomalies\r\n| where AnomalyTemplateName == iif(AnomalyTypeString_ == '*', AnomalyTemplateName, AnomalyTypeString_)\r\n| summarize count() by bin(TimeGenerated, 1h)", "size": 0, "title": "Anomalies Trend", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "areachart" }, "customWidth": "75", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let AnomalyTypeString_ = trim('\"', '{AnomalyType}');\r\nAnomalies\r\n| where AnomalyTemplateName == iif(AnomalyTypeString_ == '*', AnomalyTemplateName, AnomalyTypeString_)\r\n| extend idParam = strcat('\"id\":', Id)\r\n| sort by Score desc\r\n| project Id, AnomalyTemplateName, Entities, Description, StartTime, EndTime, Score, idParam\r\n", "size": 0, "timeContext": { "durationMs": 2592000000 }, "exportedParameters": [ { "fieldName": "Id", "parameterName": "AnomalyId", "parameterType": 1 }, { "fieldName": "AnomalyTemplateName", "parameterName": "AnomalyTemplateName", "parameterType": 1 }, { "fieldName": "Description", "parameterName": "AnomalyDescription", "parameterType": 1 }, { "fieldName": "StartTime", "parameterName": "StartTime", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Id", "formatter": 5 }, { "columnMatch": "AnomalyTemplateName", "formatter": 7, "formatOptions": { "linkTarget": "WorkbookTemplate", "linkLabel": "", "workbookContext": { "componentIdSource": "workbook", "resourceIdsSource": "workbook", "templateIdSource": "static", "templateId": "", "typeSource": "workbook", "gallerySource": "workbook", "locationSource": "default", "passSpecificParams": true, "templateParameters": [ { "name": "Id", "source": "column", "value": "Id" }, { "name": "Description", "source": "column", "value": "Description" }, { "name": "AnomalyTemplateName", "source": "column", "value": "AnomalyTemplateName" }, { "name": "StartTime", "source": "column", "value": "StartTime" }, { "name": "EndTime", "source": "column", "value": "EndTime" } ] }, "bladeOpenContext": { "bladeName": "UsageNotebookBlade", "extensionName": "AppInsightsExtension", "bladeParameters": [ { "name": "ComponentId", "source": "static", "value": "" }, { "name": "ConfigurationId", "source": "static", "value": "" }, { "name": "Type", "source": "static", "value": "sentinel" }, { "name": "WorkbookTemplateName", "source": "static", "value": "Anomaly Data Workbook" }, { "name": "NotebookParams", "source": "column", "value": "idParam" } ] } } }, { "columnMatch": "Description", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "70ch" } }, { "columnMatch": "EndTime", "formatter": 5 }, { "columnMatch": "Score", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "8ch" } }, { "columnMatch": "idParam", "formatter": 5 } ], "sortBy": [ { "itemKey": "Score", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "Score", "sortOrder": 2 } ] }, "name": "query - 1" } ] }, "name": "group - 1" } ], "fromTemplateId": "sentinel-AnomaliesVisualizationWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }