{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "## SonicWall Workbook for Microsoft Sentinel\n---\n\nWelcome! We've included a collection of queries to provide visibility into the events reported by your SonicWall firewalls.\n\nUse the available filters to update the data on the dashboard. Note that not all filters apply to every query. Edit the queries as needed to suit your needs." }, "name": "title-text" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "8a6a764e-51f5-4acb-b31e-18c8b1007249", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "description": "Select a time range to filter the dashboard's data", "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 86400000 } }, { "id": "8ad6df39-cd24-4c7c-99fd-789b502d433e", "version": "KqlParameterItem/1.0", "name": "SourceDevice", "label": "Source Device", "type": 2, "description": "Specify the source devices on which to filter", "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "CommonSecurityLog\r\n| where Computer != \"127.0.0.1\"\r\n| distinct Computer", "typeSettings": { "additionalResourceOptions": [ "value::all" ] }, "timeContext": { "durationMs": 2592000000 }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] }, { "version": "KqlParameterItem/1.0", "name": "Source_IP", "label": "Source IP", "type": 2, "description": "Specify the source IP addresses on which to filter", "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "CommonSecurityLog\r\n| summarize Count = count()/1000 by SourceIP\r\n| where SourceIP != \"\"\r\n| order by Count desc, SourceIP asc\r\n| project Value = SourceIP, Label = strcat(SourceIP, \" - \", Count, \"k\"), Selected = false", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "bb5d62ef-6b04-4b76-a04c-b745c54a7993", "value": [ "value::all" ] }, { "version": "KqlParameterItem/1.0", "name": "Destination_IP", "label": "Destination IP", "type": 2, "description": "Specify the destination IP addresses on which to filter", "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "CommonSecurityLog\r\n| summarize Count = count()/1000 by DestinationIP\r\n| where DestinationIP != \"\"\r\n| order by Count desc, DestinationIP asc\r\n| project Value = DestinationIP, Label = strcat(DestinationIP, \" - \", Count, \"k\"), Selected = false", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 2592000000 }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "id": "44c56b4f-4ec2-4a5a-8cbc-36482af1321a", "value": [ "value::all" ] }, { "id": "87a1dba0-3daf-4cc0-bf75-056c83fac52f", "version": "KqlParameterItem/1.0", "name": "ActivitySelection", "label": "Activity", "type": 2, "description": "Select the type of log activity on which to filter", "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "CommonSecurityLog\r\n| distinct Activity", "typeSettings": { "additionalResourceOptions": [ "value::all" ] }, "timeContext": { "durationMs": 2592000000 }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ "value::all" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "workbook-parameters" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Firewall Security", "expandable": true, "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Failed CLI login attempts\r\nASimNetworkSessionSonicWallFirewall\r\n| where EventOriginalType == 200\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| extend HitCounter = 1 // Assigns a count to each record\r\n| summarize Users = makeset(trim('\"', SrcUsername)), Count = sum(HitCounter) by SrcIpAddr\r\n| project SrcIpAddr, Count, UserCount = array_length(split(Users, \",\")), Users\r\n| sort by Count desc", "size": 0, "showAnalytics": true, "title": "Failed CLI Login Attempts ({TimeRange})", "noDataMessageStyle": 3, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true, "sortBy": [ { "itemKey": "Count", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "Count", "sortOrder": 2 } ] }, "customWidth": "50", "name": "query1", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n| where EventOriginalType == 200\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| summarize by SrcIpAddr, Time = TimeGenerated, User = SrcUsername\r\n| project Time, SrcIpAddr, User\r\n| sort by Time desc", "size": 0, "showAnalytics": true, "title": "Failed CLI Login Attempt Details ({TimeRange})", "noDataMessageStyle": 3, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "SourceIP" ], "expandTopLevel": false } }, "sortBy": [] }, "customWidth": "50", "name": "query2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Failed web login attempts\r\nASimNetworkSessionSonicWallFirewall\r\n| where EventOriginalType in (30, 32, 33, 243, 245, 745, 1552, 1554)\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| extend HitCounter = 1 // Assigns a count to each record\r\n| summarize Users = makeset(trim('\"', SrcUsername)), Reasons = makeset(EventMessage), Count = sum(HitCounter) by SrcIpAddr\r\n| project SrcIpAddr, Count, UserCount = array_length(split(Users, \",\")), Reasons, Users\r\n| sort by Count desc", "size": 0, "showAnalytics": true, "title": "Failed Web Login Attempts ({TimeRange})", "noDataMessageStyle": 3, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true, "sortBy": [ { "itemKey": "Count", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "Count", "sortOrder": 2 } ] }, "customWidth": "50", "name": "query3", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n| where EventOriginalType in (30, 32, 33, 243, 245, 745, 1552, 1554)\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| summarize by SrcIpAddr, Time = TimeGenerated, User = SrcUsername, EventMessage\r\n| project Time, SrcIpAddr, User, EventMessage\r\n| sort by Time desc", "size": 0, "showAnalytics": true, "title": "Failed Web Login Attempt Details ({TimeRange})", "noDataMessageStyle": 3, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "SourceIP" ], "expandTopLevel": true } }, "sortBy": [] }, "customWidth": "50", "name": "query4", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| extend\r\n LogMsgSeverity = tostring(AdditionalFields['LogMsgSeverity']),\r\n LogMsgCategory = tostring(AdditionalFields['LogMsgCategory'])\r\n| where LogMsgSeverity == \"Alert (1)\"\r\n| summarize Count = count() by EventMessage, Severity = LogMsgSeverity, Category = LogMsgCategory, ID = EventOriginalType\r\n| project-reorder ID, Severity, Category\r\n| sort by Count desc\r\n//| summarize by LogMsgID, LogMsgSeverity, LogMsgCategory, LegacyMessageCategory, Activity\r\n", "size": 0, "showAnalytics": true, "title": "High Priority Events", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true } }, "customWidth": "50", "name": "query5", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| where EventOriginalType in (82, 83)\r\n| summarize Ports = makeset(DstPortNumber), Count = count() by EventMessage, SrcIpAddr, SrcPortNumber, DstIpAddr\r\n| sort by Count", "size": 0, "showAnalytics": true, "title": "Port Scan Activity ({TimeRange})", "noDataMessageStyle": 3, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true } }, "customWidth": "60", "name": "query6", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| where EventOriginalType in (82, 83)\r\n| summarize Count = count() by SrcIpAddr\r\n| sort by Count", "size": 0, "showAnalytics": true, "title": "Port Scan Totals by IP ({TimeRange})", "noDataMessageStyle": 3, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true } }, "customWidth": "20", "name": "query7", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| where EventOriginalType in (82, 83, 177, 178, 179)\r\n| summarize Count = count() by EventMessage\r\n| sort by Count", "size": 0, "showAnalytics": true, "title": "Scan Totals by Activity ({TimeRange})", "noDataMessageStyle": 3, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 0, "formatOptions": { "aggregation": "Sum" } } ] } }, "customWidth": "20", "name": "query8", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| where EventOriginalType in (82, 83, 177, 178, 179)\r\n| summarize Count = count() by SrcIpAddr, EventMessage\r\n| sort by Count", "size": 0, "showAnalytics": true, "title": "Scan Totals by IP ({TimeRange})", "noDataMessageStyle": 3, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "SrcIpAddr" ], "expandTopLevel": true } } }, "customWidth": "40", "name": "query9", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " let HighRiskPorts = datatable (Port:int, Protocol:string, RiskType:string, RiskDescription:string)[\r\n 13,\"udp\",\"3rd Party Attacks\",\"Daytime protocol used in reflection/amplification attacks\",\r\n 17,\"udp\",\"3rd Party Attacks\",\"QOTD protocol, reflection/amplification attacks\",\r\n 19,\"udp\",\"3rd Party Attacks\",\"Chargen protocol, reflection/amplification attacks\",\r\n 20,\"tcp\",\"Unencrypted\",\"Unencrypted FTP Traffic\",\r\n 21,\"tcp\",\"Unencrypted\",\"Unencrypted FTP Traffic\",\r\n 22,\"tcp\",\"Management\",\"SSH, brute force attacks common\",\r\n 23,\"tcp\",\"Management\",\"Telnet, allows unauthenticated and/or unencrypted\",\r\n 53,\"udp\",\"3rd Party Attacks\",\"DNS, reflection/amplification attacks\",\r\n 69,\"udp\",\"Management\",\"TFTP, allows unauthenticated and/or unencrypted\",\r\n 111,\"udp\",\"Management\",\"RPC, unencrypted authentication allowed\",\r\n 111,\"tcp\",\"Management\",\"RPC, unencrypted authentication allowed\",\r\n 119,\"tcp\",\"Unsecure\",\"NNTP, unencrypted authentication\",\r\n 123,\"udp\",\"3rd Party Attacks\",\"Network Time Protocol, reflection/amplification attacks\",\r\n 135,\"tcp\",\"Management\",\"End Point Mapper, multiple remote management srvcs\",\r\n 135,\"udp\",\"Management\",\"End Point Mapper, multiple remote management srvcs\",\r\n 137,\"tcp\",\"Hacker Recon\",\"Netbios Name Service\",\r\n 137,\"udp\",\"Hacker Recon\",\"Netbios Name Service\",\r\n 138,\"tcp\",\"Hacker Recon\",\"Netbios Datagram Service\",\r\n 138,\"udp\",\"Hacker Recon\",\"Netbios Datagram Service\",\r\n 139,\"tcp\",\"Hacker Recon\",\"Netbios Session Service\",\r\n 161,\"tcp\",\"Unsecure/3rd Party Attacks\",\"SNMP, unsecure / no authentication UDP Reflection attacks\",\r\n 161,\"udp\",\"Unsecure/3rd Party Attacks\",\"SNMP, unsecure / no authentication UDP Reflection attacks\",\r\n 162,\"tcp\",\"Unsecure\",\"SNMP Trap, unsecure / no authentication\",\r\n 162,\"udp\",\"Unsecure\",\"SNMP Trap, unsecure / no authentication\",\r\n 389,\"tcp\",\"Hacker Recon/3rd Party Attacks\",\"LDAP/CLDAP\",\r\n 389,\"udp\",\"Hacker Recon/3rd Party Attacks\",\"LDAP/CLDAP\",\r\n 443,\"udp\",\"3rd Party Attacks\",\"UDP Reflection / Amplification attacks\",\r\n 445,\"tcp\",\"Unsecure\",\"SMB - well known attack vector\",\r\n 512,\"tcp\",\"Management\",\"Rexec on Linux, remote commands w/o encrypt auth\",\r\n 514,\"tcp\",\"Management\",\"Remote Shell, remote commands w/o auth or encrypt\",\r\n 593,\"tcp\",\"Management\",\"HTTP RPC EPMAP, unencrypted remote procedure call\",\r\n 593,\"udp\",\"Management\",\"HTTP RPC EPMAP, unencrypted remote procedure call\",\r\n 636,\"tcp\",\"Hacker Recon\",\"Lightweight Directory Access Protocol\",\r\n 873,\"tcp\",\"Management\",\"Rsync, unencrypted file transfer\",\r\n 1433,\"tcp\",\"Data Access/Mgmt\",\"MS SQL Management & Data Access\",\r\n 1434,\"udp\",\"Data Access/Mgmt\",\"MS SQL Monitor Port\",\r\n 1900,\"udp\",\"Hacker Recon/3rd Party Attacks\",\"Simple Service Discovery Protocol, unencrypted\",\r\n 2049,\"tcp\",\"Unsecure\",\"Network File System\",\r\n 2049,\"udp\",\"Unsecure\",\"Network File System\",\r\n 2301,\"tcp\",\"Hacker Recon\",\"Compaq Management Service, no recent incidents\",\r\n 2381,\"tcp\",\"Management\",\"Compaq Management Service, no recent incidents\",\r\n 3268,\"tcp\",\"Hacker Recon\",\"Microsoft Global Catalog LDAP\",\r\n 3306,\"tcp\",\"Data Access/Mgmt\",\"MySQL Database Management Port\",\r\n 3389,\"tcp\",\"Management/3rd Party Attacks\",\"RDP, Common brute force attack port\",\r\n 3389,\"udp\",\"Management/3rd Party Attacks\",\"RDP, Common brute force attack port\",\r\n 4333,\"tcp\",\"Data Access/Mgmt\",\"MSql\",\r\n 5353,\"udp\",\"3rd Party Attacks\",\"mDNS\",\r\n 5432,\"tcp\",\"Data Access/Mgmt\",\"PostgresSQL Database Management\",\r\n 5800,\"tcp\",\"Management\",\"VNC Remote Frame Buffer over HTTP\",\r\n 5900,\"tcp\",\"Management\",\"VNC Remote Frame Buffer over HTTP\",\r\n 5985,\"tcp\",\"Management\",\"Windows Powershell\",\r\n 5986,\"tcp\",\"Management\",\"Windows Powershell\",\r\n 6379,\"tcp\",\"Data Access/Mgmt\",\"Redis\",\r\n 7000,\"tcp\",\"Data Access/Mgmt\",\"Cassandra\",\r\n 7001,\"tcp\",\"Data Access/Mgmt\",\"Cassandra\",\r\n 7199,\"tcp\",\"Data Access/Mgmt\",\"Cassandra\",\r\n 9042,\"tcp\",\"Data Access/Mgmt\",\"Cassandra\",\r\n 9160,\"tcp\",\"Data Access/Mgmt\",\"Cassandra\",\r\n 9200,\"tcp\",\"Data Access/Mgmt\",\"Elastic Search\",\r\n 9300,\"tcp\",\"Data Access/Mgmt\",\"Elastic Search\",\r\n 9987,\"udp\",\"3rd Party Attack\",\"DSM/SCM Target Interface\",\r\n 11211,\"udp\",\"Unencrypted\",\"Memcached\",\r\n 16379,\"tcp\",\"Data Access/Mgmt\",\"Redis\",\r\n 26379,\"tcp\",\"Data Access/Mgmt\",\"Redis\",\r\n 27017,\"tcp\",\"Data Access/Mgmt\",\"MongoDB\",\r\n ];\r\n HighRiskPorts\r\n | join kind=inner(\r\n ASimNetworkSessionSonicWallFirewall\r\n | where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n | where NetworkBytes > 0\r\n | extend NetworkProtocol = tolower(NetworkProtocol)\r\n) on $left.Port == $right.DstPortNumber and $left.Protocol == $right.NetworkProtocol\r\n| summarize Count = count() by RiskType, RiskDescription, Protocol, Port, Direction = NetworkDirection\r\n| sort by Count desc", "size": 0, "showAnalytics": true, "title": "High Risk Ports/Protocols Summary ({TimeRange})", "noDataMessageStyle": 3, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "RiskType", "formatter": 5 }, { "columnMatch": "RiskDescription", "formatter": 5 }, { "columnMatch": "Count", "formatter": 0, "formatOptions": { "aggregation": "Sum" } } ], "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "RiskType" ], "expandTopLevel": true, "finalBy": "RiskDescription" } } }, "customWidth": "50", "name": "query10", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " let HighRiskPorts = datatable (Port:int, Protocol:string, RiskType:string, RiskDescription:string)[\r\n 13,\"udp\",\"3rd Party Attacks\",\"Daytime protocol used in reflection/amplification attacks\",\r\n 17,\"udp\",\"3rd Party Attacks\",\"QOTD protocol, reflection/amplification attacks\",\r\n 19,\"udp\",\"3rd Party Attacks\",\"Chargen protocol, reflection/amplification attacks\",\r\n 20,\"tcp\",\"Unencrypted\",\"Unencrypted FTP Traffic\",\r\n 21,\"tcp\",\"Unencrypted\",\"Unencrypted FTP Traffic\",\r\n 22,\"tcp\",\"Management\",\"SSH, brute force attacks common\",\r\n 23,\"tcp\",\"Management\",\"Telnet, allows unauthenticated and/or unencrypted\",\r\n 53,\"udp\",\"3rd Party Attacks\",\"DNS, reflection/amplification attacks\",\r\n 69,\"udp\",\"Management\",\"TFTP, allows unauthenticated and/or unencrypted\",\r\n 111,\"udp\",\"Management\",\"RPC, unencrypted authentication allowed\",\r\n 111,\"tcp\",\"Management\",\"RPC, unencrypted authentication allowed\",\r\n 119,\"tcp\",\"Unsecure\",\"NNTP, unencrypted authentication\",\r\n 123,\"udp\",\"3rd Party Attacks\",\"Network Time Protocol, reflection/amplification attacks\",\r\n 135,\"tcp\",\"Management\",\"End Point Mapper, multiple remote management srvcs\",\r\n 135,\"udp\",\"Management\",\"End Point Mapper, multiple remote management srvcs\",\r\n 137,\"tcp\",\"Hacker Recon\",\"Netbios Name Service\",\r\n 137,\"udp\",\"Hacker Recon\",\"Netbios Name Service\",\r\n 138,\"tcp\",\"Hacker Recon\",\"Netbios Datagram Service\",\r\n 138,\"udp\",\"Hacker Recon\",\"Netbios Datagram Service\",\r\n 139,\"tcp\",\"Hacker Recon\",\"Netbios Session Service\",\r\n 161,\"tcp\",\"Unsecure/3rd Party Attacks\",\"SNMP, unsecure / no authentication UDP Reflection attacks\",\r\n 161,\"udp\",\"Unsecure/3rd Party Attacks\",\"SNMP, unsecure / no authentication UDP Reflection attacks\",\r\n 162,\"tcp\",\"Unsecure\",\"SNMP Trap, unsecure / no authentication\",\r\n 162,\"udp\",\"Unsecure\",\"SNMP Trap, unsecure / no authentication\",\r\n 389,\"tcp\",\"Hacker Recon/3rd Party Attacks\",\"LDAP/CLDAP\",\r\n 389,\"udp\",\"Hacker Recon/3rd Party Attacks\",\"LDAP/CLDAP\",\r\n 443,\"udp\",\"3rd Party Attacks\",\"UDP Reflection / Amplification attacks\",\r\n 445,\"tcp\",\"Unsecure\",\"SMB - well known attack vector\",\r\n 512,\"tcp\",\"Management\",\"Rexec on Linux, remote commands w/o encrypt auth\",\r\n 514,\"tcp\",\"Management\",\"Remote Shell, remote commands w/o auth or encrypt\",\r\n 593,\"tcp\",\"Management\",\"HTTP RPC EPMAP, unencrypted remote procedure call\",\r\n 593,\"udp\",\"Management\",\"HTTP RPC EPMAP, unencrypted remote procedure call\",\r\n 636,\"tcp\",\"Hacker Recon\",\"Lightweight Directory Access Protocol\",\r\n 873,\"tcp\",\"Management\",\"Rsync, unencrypted file transfer\",\r\n 1433,\"tcp\",\"Data Access/Mgmt\",\"MS SQL Management & Data Access\",\r\n 1434,\"udp\",\"Data Access/Mgmt\",\"MS SQL Monitor Port\",\r\n 1900,\"udp\",\"Hacker Recon/3rd Party Attacks\",\"Simple Service Discovery Protocol, unencrypted\",\r\n 2049,\"tcp\",\"Unsecure\",\"Network File System\",\r\n 2049,\"udp\",\"Unsecure\",\"Network File System\",\r\n 2301,\"tcp\",\"Hacker Recon\",\"Compaq Management Service, no recent incidents\",\r\n 2381,\"tcp\",\"Management\",\"Compaq Management Service, no recent incidents\",\r\n 3268,\"tcp\",\"Hacker Recon\",\"Microsoft Global Catalog LDAP\",\r\n 3306,\"tcp\",\"Data Access/Mgmt\",\"MySQL Database Management Port\",\r\n 3389,\"tcp\",\"Management/3rd Party Attacks\",\"RDP, Common brute force attack port\",\r\n 3389,\"udp\",\"Management/3rd Party Attacks\",\"RDP, Common brute force attack port\",\r\n 4333,\"tcp\",\"Data Access/Mgmt\",\"MSql\",\r\n 5353,\"udp\",\"3rd Party Attacks\",\"mDNS\",\r\n 5432,\"tcp\",\"Data Access/Mgmt\",\"PostgresSQL Database Management\",\r\n 5800,\"tcp\",\"Management\",\"VNC Remote Frame Buffer over HTTP\",\r\n 5900,\"tcp\",\"Management\",\"VNC Remote Frame Buffer over HTTP\",\r\n 5985,\"tcp\",\"Management\",\"Windows Powershell\",\r\n 5986,\"tcp\",\"Management\",\"Windows Powershell\",\r\n 6379,\"tcp\",\"Data Access/Mgmt\",\"Redis\",\r\n 7000,\"tcp\",\"Data Access/Mgmt\",\"Cassandra\",\r\n 7001,\"tcp\",\"Data Access/Mgmt\",\"Cassandra\",\r\n 7199,\"tcp\",\"Data Access/Mgmt\",\"Cassandra\",\r\n 9042,\"tcp\",\"Data Access/Mgmt\",\"Cassandra\",\r\n 9160,\"tcp\",\"Data Access/Mgmt\",\"Cassandra\",\r\n 9200,\"tcp\",\"Data Access/Mgmt\",\"Elastic Search\",\r\n 9300,\"tcp\",\"Data Access/Mgmt\",\"Elastic Search\",\r\n 9987,\"udp\",\"3rd Party Attack\",\"DSM/SCM Target Interface\",\r\n 11211,\"udp\",\"Unencrypted\",\"Memcached\",\r\n 16379,\"tcp\",\"Data Access/Mgmt\",\"Redis\",\r\n 26379,\"tcp\",\"Data Access/Mgmt\",\"Redis\",\r\n 27017,\"tcp\",\"Data Access/Mgmt\",\"MongoDB\",\r\n ];\r\n HighRiskPorts\r\n | join kind=inner(\r\n ASimNetworkSessionSonicWallFirewall\r\n | where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n | where NetworkBytes > 0\r\n | where NetworkDirection == \"Inbound\"\r\n | extend NetworkProtocol = tolower(NetworkProtocol)\r\n) on $left.Port == $right.DstPortNumber and $left.Protocol == $right.NetworkProtocol\r\n| summarize Count = count() by SrcIpAddr, DstIpAddr, Protocol, Port, RiskType, RiskDescription\r\n| sort by Count desc", "size": 0, "showAnalytics": true, "title": "Inbound High Risk Ports/Protocols ({TimeRange})", "noDataMessageStyle": 3, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true } }, "name": "query11", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " let HighRiskPorts = datatable (Port:int, Protocol:string, RiskType:string, RiskDescription:string)[\r\n 13,\"udp\",\"3rd Party Attacks\",\"Daytime protocol used in reflection/amplification attacks\",\r\n 17,\"udp\",\"3rd Party Attacks\",\"QOTD protocol, reflection/amplification attacks\",\r\n 19,\"udp\",\"3rd Party Attacks\",\"Chargen protocol, reflection/amplification attacks\",\r\n 20,\"tcp\",\"Unencrypted\",\"Unencrypted FTP Traffic\",\r\n 21,\"tcp\",\"Unencrypted\",\"Unencrypted FTP Traffic\",\r\n 22,\"tcp\",\"Management\",\"SSH, brute force attacks common\",\r\n 23,\"tcp\",\"Management\",\"Telnet, allows unauthenticated and/or unencrypted\",\r\n 53,\"udp\",\"3rd Party Attacks\",\"DNS, reflection/amplification attacks\",\r\n 69,\"udp\",\"Management\",\"TFTP, allows unauthenticated and/or unencrypted\",\r\n 111,\"udp\",\"Management\",\"RPC, unencrypted authentication allowed\",\r\n 111,\"tcp\",\"Management\",\"RPC, unencrypted authentication allowed\",\r\n 119,\"tcp\",\"Unsecure\",\"NNTP, unencrypted authentication\",\r\n 123,\"udp\",\"3rd Party Attacks\",\"Network Time Protocol, reflection/amplification attacks\",\r\n 135,\"tcp\",\"Management\",\"End Point Mapper, multiple remote management srvcs\",\r\n 135,\"udp\",\"Management\",\"End Point Mapper, multiple remote management srvcs\",\r\n 137,\"tcp\",\"Hacker Recon\",\"Netbios Name Service\",\r\n 137,\"udp\",\"Hacker Recon\",\"Netbios Name Service\",\r\n 138,\"tcp\",\"Hacker Recon\",\"Netbios Datagram Service\",\r\n 138,\"udp\",\"Hacker Recon\",\"Netbios Datagram Service\",\r\n 139,\"tcp\",\"Hacker Recon\",\"Netbios Session Service\",\r\n 161,\"tcp\",\"Unsecure/3rd Party Attacks\",\"SNMP, unsecure / no authentication UDP Reflection attacks\",\r\n 161,\"udp\",\"Unsecure/3rd Party Attacks\",\"SNMP, unsecure / no authentication UDP Reflection attacks\",\r\n 162,\"tcp\",\"Unsecure\",\"SNMP Trap, unsecure / no authentication\",\r\n 162,\"udp\",\"Unsecure\",\"SNMP Trap, unsecure / no authentication\",\r\n 389,\"tcp\",\"Hacker Recon/3rd Party Attacks\",\"LDAP/CLDAP\",\r\n 389,\"udp\",\"Hacker Recon/3rd Party Attacks\",\"LDAP/CLDAP\",\r\n 443,\"udp\",\"3rd Party Attacks\",\"UDP Reflection / Amplification attacks\",\r\n 445,\"tcp\",\"Unsecure\",\"SMB - well known attack vector\",\r\n 512,\"tcp\",\"Management\",\"Rexec on Linux, remote commands w/o encrypt auth\",\r\n 514,\"tcp\",\"Management\",\"Remote Shell, remote commands w/o auth or encrypt\",\r\n 593,\"tcp\",\"Management\",\"HTTP RPC EPMAP, unencrypted remote procedure call\",\r\n 593,\"udp\",\"Management\",\"HTTP RPC EPMAP, unencrypted remote procedure call\",\r\n 636,\"tcp\",\"Hacker Recon\",\"Lightweight Directory Access Protocol\",\r\n 873,\"tcp\",\"Management\",\"Rsync, unencrypted file transfer\",\r\n 1433,\"tcp\",\"Data Access/Mgmt\",\"MS SQL Management & Data Access\",\r\n 1434,\"udp\",\"Data Access/Mgmt\",\"MS SQL Monitor Port\",\r\n 1900,\"udp\",\"Hacker Recon/3rd Party Attacks\",\"Simple Service Discovery Protocol, unencrypted\",\r\n 2049,\"tcp\",\"Unsecure\",\"Network File System\",\r\n 2049,\"udp\",\"Unsecure\",\"Network File System\",\r\n 2301,\"tcp\",\"Hacker Recon\",\"Compaq Management Service, no recent incidents\",\r\n 2381,\"tcp\",\"Management\",\"Compaq Management Service, no recent incidents\",\r\n 3268,\"tcp\",\"Hacker Recon\",\"Microsoft Global Catalog LDAP\",\r\n 3306,\"tcp\",\"Data Access/Mgmt\",\"MySQL Database Management Port\",\r\n 3389,\"tcp\",\"Management/3rd Party Attacks\",\"RDP, Common brute force attack port\",\r\n 3389,\"udp\",\"Management/3rd Party Attacks\",\"RDP, Common brute force attack port\",\r\n 4333,\"tcp\",\"Data Access/Mgmt\",\"MSql\",\r\n 5353,\"udp\",\"3rd Party Attacks\",\"mDNS\",\r\n 5432,\"tcp\",\"Data Access/Mgmt\",\"PostgresSQL Database Management\",\r\n 5800,\"tcp\",\"Management\",\"VNC Remote Frame Buffer over HTTP\",\r\n 5900,\"tcp\",\"Management\",\"VNC Remote Frame Buffer over HTTP\",\r\n 5985,\"tcp\",\"Management\",\"Windows Powershell\",\r\n 5986,\"tcp\",\"Management\",\"Windows Powershell\",\r\n 6379,\"tcp\",\"Data Access/Mgmt\",\"Redis\",\r\n 7000,\"tcp\",\"Data Access/Mgmt\",\"Cassandra\",\r\n 7001,\"tcp\",\"Data Access/Mgmt\",\"Cassandra\",\r\n 7199,\"tcp\",\"Data Access/Mgmt\",\"Cassandra\",\r\n 9042,\"tcp\",\"Data Access/Mgmt\",\"Cassandra\",\r\n 9160,\"tcp\",\"Data Access/Mgmt\",\"Cassandra\",\r\n 9200,\"tcp\",\"Data Access/Mgmt\",\"Elastic Search\",\r\n 9300,\"tcp\",\"Data Access/Mgmt\",\"Elastic Search\",\r\n 9987,\"udp\",\"3rd Party Attack\",\"DSM/SCM Target Interface\",\r\n 11211,\"udp\",\"Unencrypted\",\"Memcached\",\r\n 16379,\"tcp\",\"Data Access/Mgmt\",\"Redis\",\r\n 26379,\"tcp\",\"Data Access/Mgmt\",\"Redis\",\r\n 27017,\"tcp\",\"Data Access/Mgmt\",\"MongoDB\",\r\n ];\r\n HighRiskPorts\r\n | join kind=inner(\r\n ASimNetworkSessionSonicWallFirewall\r\n | where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n | where NetworkBytes > 0\r\n | where NetworkDirection == \"Outbound\"\r\n | extend NetworkProtocol = tolower(NetworkProtocol)\r\n) on $left.Port == $right.DstPortNumber and $left.Protocol == $right.NetworkProtocol\r\n| summarize Count = count() by SrcIpAddr, DstIpAddr, Protocol, Port, RiskType, RiskDescription\r\n| sort by Count desc", "size": 0, "showAnalytics": true, "title": "Outbound High Risk Ports/Protocols ({TimeRange})", "noDataMessageStyle": 3, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true } }, "name": "query12", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "Tip: Edit the query to modify the list of suspicious TLDs.", "style": "info" }, "name": "text - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SuspiciousTLDs = datatable (TLD:string, Description:string) [\r\n \"sbs\", \"Special Broadcasting Service Corporation\",\r\n \"cyou\", \"ShortDot SA\",\r\n \"quest\", \"Quest ION Limited\",\r\n \"autos\", \"Autos\",\r\n \"top\", \"Jiangsu Bangning Science and Technology Co\",\r\n \"skin\", \"XYZ.COM LLC\",\r\n \"cfd\", \"CFD\",\r\n \"best\", \"Best\",\r\n \"bio\", \"Bio\",\r\n \"cloud\", \"Cloud\",\r\n \"makeup\", \"XYZ.COM LLC\",\r\n \"icu\", \"ICU\",\r\n \"shop\", \"Shop\",\r\n \"ltd\", \"Ltd\",\r\n \"xyz\", \"XYZ\",\r\n \"help\", \"Help\",\r\n \"monster\", \"Monster\",\r\n \"ink\", \"Ink\",\r\n \"pro\", \"Pro\",\r\n \"bd\", \"Bangladesh\",\r\n \"run\", \"Run\",\r\n \"live\", \"Rightside\",\r\n \"life\", \"Life\",\r\n \"pics\", \"Pics\",\r\n \"th\", \"Thailand\",\r\n \"py\", \"Paraguay\",\r\n \"club\", \"Club\",\r\n \"id\", \"Indonesia\",\r\n \"today\", \"Today\",\r\n \"pk\", \"Pakistan\",\r\n \"ng\", \"Nigeria\",\r\n \"website\", \"Website\",\r\n \"to\", \"Tonga\",\r\n \"store\", \"Store\",\r\n \"beauty\", \"Beauty\",\r\n \"space\", \"Space\",\r\n \"tz\", \"Tanzania\",\r\n \"link\", \"Link\",\r\n \"lol\", \"Lol\",\r\n \"mk\", \"Macedonia\",\r\n \"click\", \"Click\",\r\n \"site\", \"Site\",\r\n \"cc\", \"Cocos (Keeling) Islands\",\r\n \"su\", \"Russian Federation\",\r\n \"cam\", \"Cam\",\r\n \"cn\", \"China\",\r\n \"buzz\", \"Buzz\",\r\n \"lk\", \"Sri Lanka\",\r\n \"in\", \"India\",\r\n \"tr\", \"Turkey\",\r\n \"tk\", \"Tokelau\",\r\n \"pw\", \"Palau\",\r\n \"ws\", \"Samoa\",\r\n \"ml\", \"Mali\",\r\n \"ga\", \"Gabon\",\r\n \"cf\", \"Central African Republic\",\r\n \"gq\", \"Equatorial Guinea\",\r\n \"zw\", \"Zimbabwe\",\r\n \"am\", \"Armenia\",\r\n \"date\", \"Date\",\r\n \"cd\", \"Congo, Democratic Republic\",\r\n \"bid\", \"Bid\",\r\n \"tokyo\", \"Tokyo\",\r\n \"cm\", \"Cameroon\",\r\n \"uno\", \"Uno\",\r\n \"email\", \"Email\",\r\n \"stream\", \"Stream\",\r\n \"info\", \"Info\",\r\n \"rest\", \"Rest\",\r\n \"casa\", \"Casa\",\r\n \"support\", \"Support\",\r\n \"win\", \"Win\"\r\n];\r\nASimWebSessionSonicWallFirewall\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| where NetworkBytes > 0\r\n| where isnotempty(Url)\r\n| extend Domain = extract(@\"([a-zA-Z0-9-.]+)+(?:\\/.*)?\", 1, Url)\r\n| where not(Domain matches regex (@\"\\b\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\b\")) and Domain contains \".\"\r\n| extend TLD = extract(@\"(?:[a-zA-Z0-9-]*\\.)+([a-zA-Z0-9-]+)(?:\\/.*)?\", 1, Url)\r\n| lookup SuspiciousTLDs on TLD\r\n| where isnotempty(Description)\r\n| extend IANA = strcat(\"https://www.iana.org/domains/root/db/\", TLD)\r\n| project Time = TimeGenerated, TLD = toupper(TLD), Description, IANA, Domain, EventMessage, SrcIpAddr, EventResult, DvcAction", "size": 0, "showAnalytics": true, "title": "Detailed Suspicious TLD Activity ({TimeRange})", "noDataMessageStyle": 3, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "IANA", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "IANA Infomation" } } ], "filter": true } }, "name": "query13", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let SuspiciousTLDs = datatable (TLD:string, Description:string) [\r\n \"sbs\", \"Special Broadcasting Service Corporation\",\r\n \"cyou\", \"ShortDot SA\",\r\n \"quest\", \"Quest ION Limited\",\r\n \"autos\", \"Autos\",\r\n \"top\", \"Jiangsu Bangning Science and Technology Co\",\r\n \"skin\", \"XYZ.COM LLC\",\r\n \"cfd\", \"CFD\",\r\n \"best\", \"Best\",\r\n \"bio\", \"Bio\",\r\n \"cloud\", \"Cloud\",\r\n \"makeup\", \"XYZ.COM LLC\",\r\n \"icu\", \"ICU\",\r\n \"shop\", \"Shop\",\r\n \"ltd\", \"Ltd\",\r\n \"xyz\", \"XYZ\",\r\n \"help\", \"Help\",\r\n \"monster\", \"Monster\",\r\n \"ink\", \"Ink\",\r\n \"pro\", \"Pro\",\r\n \"bd\", \"Bangladesh\",\r\n \"run\", \"Run\",\r\n \"live\", \"Rightside\",\r\n \"life\", \"Life\",\r\n \"pics\", \"Pics\",\r\n \"th\", \"Thailand\",\r\n \"py\", \"Paraguay\",\r\n \"club\", \"Club\",\r\n \"id\", \"Indonesia\",\r\n \"today\", \"Today\",\r\n \"pk\", \"Pakistan\",\r\n \"ng\", \"Nigeria\",\r\n \"website\", \"Website\",\r\n \"to\", \"Tonga\",\r\n \"store\", \"Store\",\r\n \"beauty\", \"Beauty\",\r\n \"space\", \"Space\",\r\n \"tz\", \"Tanzania\",\r\n \"link\", \"Link\",\r\n \"lol\", \"Lol\",\r\n \"mk\", \"Macedonia\",\r\n \"click\", \"Click\",\r\n \"site\", \"Site\",\r\n \"cc\", \"Cocos (Keeling) Islands\",\r\n \"su\", \"Russian Federation\",\r\n \"cam\", \"Cam\",\r\n \"cn\", \"China\",\r\n \"buzz\", \"Buzz\",\r\n \"lk\", \"Sri Lanka\",\r\n \"in\", \"India\",\r\n \"tr\", \"Turkey\",\r\n \"tk\", \"Tokelau\",\r\n \"pw\", \"Palau\",\r\n \"ws\", \"Samoa\",\r\n \"ml\", \"Mali\",\r\n \"ga\", \"Gabon\",\r\n \"cf\", \"Central African Republic\",\r\n \"gq\", \"Equatorial Guinea\",\r\n \"zw\", \"Zimbabwe\",\r\n \"am\", \"Armenia\",\r\n \"date\", \"Date\",\r\n \"cd\", \"Congo, Democratic Republic\",\r\n \"bid\", \"Bid\",\r\n \"tokyo\", \"Tokyo\",\r\n \"cm\", \"Cameroon\",\r\n \"uno\", \"Uno\",\r\n \"email\", \"Email\",\r\n \"stream\", \"Stream\",\r\n \"info\", \"Info\",\r\n \"rest\", \"Rest\",\r\n \"casa\", \"Casa\",\r\n \"support\", \"Support\",\r\n \"win\", \"Win\"\r\n];\r\nASimWebSessionSonicWallFirewall\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| where NetworkBytes > 0\r\n| where isnotempty(Url)\r\n| extend Domain = extract(@\"([a-zA-Z0-9-.]+)+(?:\\/.*)?\", 1, Url)\r\n| where not(Domain matches regex (@\"\\b\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\b\")) and Domain contains \".\"\r\n| extend TLD = extract(@\"(?:[a-zA-Z0-9-]*\\.)+([a-zA-Z0-9-]+)(?:\\/.*)?\", 1, Url)\r\n| lookup SuspiciousTLDs on TLD\r\n| where isnotempty(Description)\r\n| extend IANA = strcat(\"https://www.iana.org/domains/root/db/\", TLD)\r\n| summarize Count = count() by TLD = toupper(TLD), Description, Domain, IANA\r\n| sort by Count desc\r\n// SuspiciousTLDs\r\n// | join kind=inner(\r\n// ASimNetworkSessionSonicWallFirewall\r\n//) on $right.RequestedURL contains $left.TopLevelDomain\r\n//| project TimeGenerated, SourceIP, SourcePort, DestinationIP, DestinationPort, FirewallAction\r\n//| summarize Count = count() by Activity, SourceIP, DestinationIP, DestinationPort\r\n//| sort by Count", "size": 0, "showAnalytics": true, "title": "Suspicious TLD Activity by TLD ({TimeRange})", "noDataMessageStyle": 3, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "IANA", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "IANA Infomation" } }, { "columnMatch": "Count", "formatter": 0, "formatOptions": { "aggregation": "Sum" } } ], "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "TLD" ], "expandTopLevel": false } } }, "customWidth": "55", "name": "query14", "styleSettings": { "showBorder": true } } ] }, "name": "firewall-security", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Activity Breakdown", "expandable": true, "items": [ { "type": 1, "content": { "json": "Get insight into the types, severity, and volume of events. Use the filters at the top of the workbook to adjust time ranges and more.", "style": "info" }, "name": "text - 8" }, { "type": 1, "content": { "json": "These are breakdowns of the various activities.\r\n - Activity Breakdown displays the variety of events by their count. A tile and table view are provided.\r\n - Event Breakdown displays the number of events by severity in a chart view" }, "name": "text - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| where \"{Source_IP:lable}\" == \"All\" or SrcIpAddr in ({Source_IP})\r\n| where \"{ActivitySelection:lable}\" == \"All\" or EventMessage in ({ActivitySelection})\r\n| extend\r\n LogMsgSeverity = tostring(AdditionalFields['LogMsgSeverity']),\r\n LogMsgCategory = tostring(AdditionalFields['LogMsgCategory'])\r\n| summarize Count=count() by EventMessage, LogMsgSeverity, LogMsgCategory", "size": 0, "showAnalytics": true, "title": "Activity Breakdown ({TimeRange})", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "Activity", "formatter": 1 }, "subtitleContent": { "columnMatch": "LogMsgCategory" }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "LogMsgSeverity" }, "showBorder": false } }, "name": "query1", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| where \"{Source_IP:lable}\" == \"All\" or SrcIpAddr in ({Source_IP})\r\n| where \"{ActivitySelection:lable}\" == \"All\" or EventMessage in ({ActivitySelection})\r\n| extend\r\n LogMsgSeverity = tostring(AdditionalFields['LogMsgSeverity']),\r\n LogMsgCategory = tostring(AdditionalFields['LogMsgCategory'])\r\n| summarize Count = count() by EventMessage, EventOriginalType, LogMsgSeverity, LogMsgCategory\r\n| project-rename ID = EventOriginalType, Severity = LogMsgSeverity, Category = LogMsgCategory\r\n| order by Count desc\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Activity Breakdown ({TimeRange})", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 0, "formatOptions": { "aggregation": "Sum", "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "Count", "color": "orange" } ] } } } ], "filter": true, "sortBy": [ { "itemKey": "Count", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "Count", "sortOrder": 2 } ], "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Activity", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "Activity", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "55", "name": "query2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| where \"{Source_IP:lable}\" == \"All\" or SrcIpAddr in ({Source_IP})\r\n| where \"{Destination_IP:lable}\" == \"All\" or DstIpAddr in ({Destination_IP})\r\n| where \"{ActivitySelection:lable}\" == \"All\" or EventMessage in ({ActivitySelection})\r\n| extend\r\n LogMsgSeverity = tostring(AdditionalFields['LogMsgSeverity'])\r\n| summarize Count=count() by LogMsgSeverity", "size": 0, "showAnalytics": true, "title": "Event Severity Breakdown ({TimeRange})", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Activity", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "Activity", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "30", "name": "query3", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| extend\r\n LogMsgSeverity = tostring(AdditionalFields['LogMsgSeverity']),\r\n LogMsgCategory = tostring(AdditionalFields['LogMsgCategory'])\r\n| summarize Count = count() by EventMessage, EventOriginalType, LogMsgSeverity, LogMsgCategory\r\n| project-rename ID = EventOriginalType, Severity = LogMsgSeverity, Category = LogMsgCategory\r\n| order by Count desc", "size": 0, "showAnalytics": true, "title": "Activities grouped by Severity, then Category", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "Severity", "Category" ], "expandTopLevel": true }, "sortBy": [ { "itemKey": "$gen_count_$gen_group_0", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "$gen_count_$gen_group_0", "sortOrder": 1 } ] }, "customWidth": "75", "name": "query4", "styleSettings": { "showBorder": true } } ] }, "name": "activity-breakdown", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Content Filtering", "expandable": true, "items": [ { "type": 1, "content": { "json": "View blocked websites, categories, and more at a glance. Use the filters at the top of the workbook to customize your view.\r\n\r\nTo verify SonicWall Content Filtering ratings or to request a rating review, please visit the [Capture Labs CFS Lookup page](https://capturelabs.sonicwall.com/m/feature/cfs)", "style": "info" }, "name": "text - 3" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "b7c2d4df-007d-433e-8695-352fc0a8284f", "version": "KqlParameterItem/1.0", "name": "CFSCategory", "label": "CFS Category", "type": 2, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "ASimWebSessionSonicWallFirewall(false)\r\n| extend\r\n CFSCategoryID = tostring(AdditionalFields['CFSCategoryID']),\r\n CFSCategoryName = tostring(AdditionalFields['CFSCategoryName'])\r\n| where isnotempty(CFSCategoryID)\r\n| summarize by CFSCategoryID, CFSCategoryName\r\n| sort by CFSCategoryName asc\r\n| project value = CFSCategoryID, label = coalesce(trim('\"', CFSCategoryName), \"N/A\")", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Top 50 CFS Domains Blocked with blocked Usernames and CFS Policies\r\nASimWebSessionSonicWallFirewall\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| where \"{Source_IP:lable}\" == \"All\" or SrcIpAddr in ({Source_IP})\r\n| extend\r\n CFSCategoryID = tostring(AdditionalFields['CFSCategoryID']),\r\n CFSCategoryName = tostring(AdditionalFields['CFSCategoryName']),\r\n CFSPolicyName = tostring(AdditionalFields['CFSPolicyName'])\r\n| where \"{CFSCategory:lable}\" == \"All\" or CFSCategoryID in ({CFSCategory:value})\r\n| where EventMessage == \"Website Blocked\"\r\n| extend Url = trim(@\"(/.*)\", Url)\r\n| extend HitCounter = 1\r\n| summarize Users = makeset(trim('\"', SrcUsername)), Policies = makeset(trim('\"', CFSPolicyName)), Count = sum(HitCounter) by Url, Category = CFSCategoryName\r\n| top 50 by Count desc\r\n", "size": 0, "showAnalytics": true, "title": "Top 50 CFS Domains Blocked ({TimeRange})", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "sortBy": [] }, "name": "query1", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimWebSessionSonicWallFirewall\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| where \"{Source_IP:lable}\" == \"All\" or SrcIpAddr in ({Source_IP})\r\n| where EventMessage == \"Website Blocked\"\r\n| extend\r\n CFSCategoryName = tostring(AdditionalFields['CFSCategoryName']),\r\n CFSPolicyName = tostring(AdditionalFields['CFSPolicyName'])\r\n| summarize Policies = makeset(CFSPolicyName), BlockedCount = count() by CFSCategoryName\r\n| project-rename Category = CFSCategoryName\r\n| sort by BlockedCount\r\n", "size": 1, "showAnalytics": true, "title": "CFS Categories Blocked ({TimeRange})", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 500 }, "sortBy": [] }, "customWidth": "50", "name": "query2", "styleSettings": { "maxWidth": "50", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where \"{SourceDevice:lable}\" == \"All\" or Computer in ({SourceDevice})\r\n| where \"{Source_IP:lable}\" == \"All\" or SourceIP in ({Source_IP})\r\n| where Activity == \"Website Blocked\"\r\n| extend\r\n CFSCategoryID = extract(@'(\\d+)\\s', 1, column_ifexists(\"Reason\", \"\"))\r\n , CFSCategoryName = extract(@'.*-(\"(.*))', 1, column_ifexists(\"Reason\", \"\"))\r\n , CFSPolicyName = extract(@'Policy: (.*), Info:', 1, column_ifexists(\"DeviceCustomString6\", \"\"))\r\n| summarize BlockedCount = count() by CFSPolicyName\r\n| sort by BlockedCount desc", "size": 1, "showAnalytics": true, "title": "CFS Blocked Sites by Policy ({TimeRange})", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "25", "name": "query3", "styleSettings": { "maxWidth": "25", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// CFS Blocks by User\r\nASimWebSessionSonicWallFirewall\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| where EventMessage == \"Website Blocked\"\r\n| extend\r\n CFSCategoryName = tostring(AdditionalFields['CFSCategoryName']),\r\n CFSPolicyName = tostring(AdditionalFields['CFSPolicyName'])\r\n| extend SrcUsername = coalesce(SrcUsername, \"No username\")\r\n| summarize Policies = makeset(CFSPolicyName), Categories = makeset(trim('\"', CFSCategoryName)), BlockedCount = count() by User = SrcUsername\r\n| sort by BlockedCount", "size": 1, "showAnalytics": true, "title": "CFS Blocks by User ({TimeRange})", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "sortBy": [] }, "name": "query4", "styleSettings": { "showBorder": true } } ] }, "name": "cfs", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Denied By Country", "expandable": true, "items": [ { "type": 1, "content": { "json": "A window into denied inbound/outbound traffic by country. Use the filters at the top of the workbook to adjust time ranges and more.\r\n\r\n**Country data is available from SonicOS log message IDs 1199 and 1198.**", "style": "info" }, "name": "text - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| where \"{Source_IP:lable}\" == \"All\" or SrcIpAddr in ({Source_IP})\r\n| where \"{Destination_IP:lable}\" == \"All\" or DstIpAddr in ({Destination_IP})\r\n| where SrcZone == \"WAN\" and EventResult == \"Failure\"\r\n| where EventOriginalType in (1199, 1198)\r\n| summarize DeniedCount = count(), NetworkBytes = sum(NetworkBytes) by Country = coalesce(SrcGeoCountry, \"#N/A\")\r\n| order by DeniedCount desc", "size": 0, "showAnalytics": true, "title": "Denied Inbound Traffic by Country ({TimeRange})", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "country_name", "formatter": 1 }, "leftContent": { "columnMatch": "DeniedCount", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "country_name", "formatter": 1 }, "centerContent": { "columnMatch": "DeniedCount", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "30", "name": "query1", "styleSettings": { "maxWidth": "50", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n// Look for dropped inbound traffic\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| where \"{Source_IP:lable}\" == \"All\" or SrcIpAddr in ({Source_IP})\r\n| where \"{Destination_IP:lable}\" == \"All\" or DstIpAddr in ({Destination_IP})\r\n| where SrcZone == \"WAN\" and EventResult == \"Failure\"\r\n| where EventOriginalType in (1199, 1198)\r\n// Summarize the data by number of messages and the sum of the received bytes.\r\n| summarize DeniedCount = count(), NetworkBytes = sum(NetworkBytes) by Country = coalesce(SrcGeoCountry, \"#N/A\")\r\n| top 10 by DeniedCount desc", "size": 0, "showAnalytics": true, "title": "Top 10 Denied Inbound Traffic by Country ({TimeRange})", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "country_name", "formatter": 1 }, "leftContent": { "columnMatch": "DeniedCount", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "country_name", "formatter": 1 }, "centerContent": { "columnMatch": "DeniedCount", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "30", "name": "query2", "styleSettings": { "maxWidth": "50", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| where \"{Source_IP:lable}\" == \"All\" or SrcIpAddr in ({Source_IP})\r\n| where \"{Destination_IP:lable}\" == \"All\" or DstIpAddr in ({Destination_IP})\r\n// Look for dropped inbound traffic\r\n| where SrcZone == \"WAN\" and EventResult == \"Failure\"\r\n| where EventOriginalType in (1199, 1198)\r\n// Summarize the data by number of messages and the sum of the received bytes.\r\n| summarize Events = makeset(EventMessage), DeniedCount = count(), NetworkBytes = sum(NetworkBytes) by Country = coalesce(SrcGeoCountry, \"#N/A\"), Protocol = NetworkProtocol, DstPort = DstPortNumber, SrcIpAddr\r\n| order by DeniedCount desc\r\n//TotalDeniedCount = sum(DeniedCount)\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Denied Inbound Traffic Detail by Country ({TimeRange})", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Group", "formatter": 1 }, { "columnMatch": "DeniedCount", "formatter": 0, "formatOptions": { "aggregation": "Sum" } }, { "columnMatch": "TotalBytesReceived", "formatter": 0, "formatOptions": { "aggregation": "Sum" } } ], "hierarchySettings": { "treeType": 1, "groupBy": [ "Country" ], "expandTopLevel": true } }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "country_name", "formatter": 1 }, "leftContent": { "columnMatch": "DeniedCount", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "country_name", "formatter": 1 }, "centerContent": { "columnMatch": "DeniedCount", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "75", "name": "query3", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Denied outbound traffic by country\r\nASimNetworkSessionSonicWallFirewall\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| where \"{Source_IP:lable}\" == \"All\" or SrcIpAddr in ({Source_IP})\r\n| where \"{Destination_IP:lable}\" == \"All\" or DstIpAddr in ({Destination_IP})\r\n// Look for dropped outbound traffic traffic\r\n| where DstZone == \"WAN\" and SrcZone != \"WAN\" and EventResult == \"Failure\"\r\n| where EventOriginalType in (1199, 1198)\r\n// Summarize the data by number of messages\r\n| summarize Events = makeset(EventMessage), DeniedCount = count() by Country = coalesce(DstGeoCountry, \"#N/A\"), Protocol = NetworkProtocol, DstPort = DstPortNumber, DstIpAddr\r\n| order by DeniedCount desc", "size": 0, "showAnalytics": true, "title": "Denied Outbound Traffic Detail by Country ({TimeRange})", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Group", "formatter": 1 }, { "columnMatch": "DeniedCount", "formatter": 0, "formatOptions": { "aggregation": "Sum" } } ], "hierarchySettings": { "treeType": 1, "groupBy": [ "Country" ], "expandTopLevel": true } }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "country_name", "formatter": 1 }, "leftContent": { "columnMatch": "DeniedCount", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "country_name", "formatter": 1 }, "centerContent": { "columnMatch": "DeniedCount", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "75", "name": "query4", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Denied outbound traffic by country\r\nASimNetworkSessionSonicWallFirewall\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| where \"{Source_IP:lable}\" == \"All\" or SrcIpAddr in ({Source_IP})\r\n| where \"{Destination_IP:lable}\" == \"All\" or DstIpAddr in ({Destination_IP})\r\n// Look for dropped outbound traffic traffic\r\n| where DstZone == \"WAN\" and SrcZone != \"WAN\" and EventResult == \"Failure\"\r\n| where EventOriginalType in (1199, 1198)\r\n// Summarize the data by number of messages\r\n| summarize DeniedCount = count() by Country = coalesce(DstGeoCountry, \"#N/A\")\r\n| order by DeniedCount desc", "size": 0, "showAnalytics": true, "title": "Denied Outbound Traffic by Country ({TimeRange})", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "25", "name": "query5", "styleSettings": { "maxWidth": "50", "showBorder": true } } ] }, "name": "denied-by-country", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Security Services", "expandable": true, "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n//| where Activity in (\"Application Control Detection Alert\", \"Application Control Prevention Alert\")\r\n| where EventOriginalType in (1154, 1155, 794, 795, 1200, 1201, 1476, 1477, 1518, 1519, 14, 809, 1631, 1198, 1199, 1474, 1475, 789, 790, 608, 609, 797, 798, 799)\r\n| summarize Count = count() by EventMessage, EventOriginalType\r\n//| summarize Count = count() by AppSignatureID, AppSignatureName, AppCategoryName\r\n//| project-reorder AppSignatureName", "size": 0, "showAnalytics": true, "title": "Observed Threats", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Activity", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "showLegend": true, "seriesLabelSettings": [ { "seriesName": "Geo IP Responder Blocked", "label": "Geo Responders Blocked", "comment": "Responder IPs blocked by Geo-IP" }, { "seriesName": "Application Control Detection Alert", "label": "App Control Detections", "comment": "App Control 'Log' Events" }, { "seriesName": "Geo IP Initiator Blocked", "label": "Geo Initiators Blocked", "comment": "Initiator IPs blocked by Geo-IP" }, { "seriesName": "IPS Detection Alert", "label": "Intrusions Detected", "comment": "IPS 'Log' Events" }, { "seriesName": "Website Blocked", "label": "Websites Blocked", "comment": "Websites blocked by Content Filtering" }, { "seriesName": "IPS Prevention Alert", "label": "Intrusions Prevented", "comment": "IPS 'Block' Events" }, { "seriesName": "Application Control Prevention Alert", "label": "App Control Preventions", "comment": "App Control 'Block' Events" }, { "seriesName": "Capture ATP Sandbox Verdict", "label": "File Verdicts Received", "comment": "Verdicts received from Capture ATP" }, { "seriesName": "Gateway Anti-Virus Alert", "label": "Malware Blocked", "comment": "Malware blocked by Gateway Anti-Virus" } ] } }, "name": "query1", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| where EventOriginalType in (1154, 795, 809, 1631, 789, 608, 797, 798, 799)\r\n| extend CaptureATPVerdict = tostring(AdditionalFields['CaptureATPVerdict'])\r\n| summarize Count = count() by EventMessage, EventOriginalType, CaptureATPVerdict\r\n//| summarize Count = count() by AppSignatureID, AppSignatureName, AppCategoryName\r\n//| project-reorder AppSignatureName", "size": 0, "showAnalytics": true, "title": "Observed Detections ({TimeRange})", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "EventMessage", "formatter": 1 }, "subtitleContent": { "columnMatch": "EventOriginalType" }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false }, "chartSettings": { "showLegend": true, "seriesLabelSettings": [ { "seriesName": "Geo IP Responder Blocked", "label": "Geo Responders Blocked", "comment": "Responder IPs blocked by Geo-IP" }, { "seriesName": "Application Control Detection Alert", "label": "App Control Detections", "comment": "App Control 'Log' Events" }, { "seriesName": "Geo IP Initiator Blocked", "label": "Geo Initiators Blocked", "comment": "Initiator IPs blocked by Geo-IP" }, { "seriesName": "IPS Detection Alert", "label": "Intrusions Detected", "comment": "IPS 'Log' Events" }, { "seriesName": "Website Blocked", "label": "Websites Blocked", "comment": "Websites blocked by Content Filtering" }, { "seriesName": "IPS Prevention Alert", "label": "Intrusions Prevented", "comment": "IPS 'Block' Events" }, { "seriesName": "Application Control Prevention Alert", "label": "App Control Preventions", "comment": "App Control 'Block' Events" }, { "seriesName": "Capture ATP Sandbox Verdict", "label": "File Verdicts Received", "comment": "Verdicts received from Capture ATP" }, { "seriesName": "Gateway Anti-Virus Alert", "label": "Malware Blocked", "comment": "Malware blocked by Gateway Anti-Virus" } ] } }, "name": "query2", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "App Control", "expandable": true, "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n| where EventMessage == \"Application Control Detection Alert\"\r\n| extend\r\n AppSignatureID = coalesce(SrcAppId, DstAppId, ThreatId),\r\n AppSignatureName = coalesce(SrcAppName, DstAppName)\r\n| extend\r\n AppIDName = extract(@' (.*) --', 1, AppSignatureName), // this should be the name of the application in app control (already in the src/dst appname.)\r\n AppCategoryName = extract(@'^[\"]([a-zA-Z-]+)', 1, AppSignatureName)\r\n| extend\r\n AppSignatureName = trim('\"', extract(@'.*-- (.*\\S)', 1, AppSignatureName))\r\n| summarize Count = count() by AppSignatureID, AppSignatureName, AppIDName, AppCategoryName\r\n| top 25 by Count desc\r\n| project-reorder AppSignatureName", "size": 0, "showAnalytics": true, "title": "Top 25 Signatures Detected", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "AppSignatureName", "formatter": 1 }, "subtitleContent": { "columnMatch": "AppIDName", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "secondaryContent": { "columnMatch": "AppCategoryName", "formatter": 1 }, "showBorder": false } }, "customWidth": "50", "name": "query1ac", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n| where EventMessage == \"Application Control Prevention Alert\"\r\n| extend\r\n AppSignatureID = coalesce(SrcAppId, DstAppId, ThreatId),\r\n AppSignatureName = coalesce(SrcAppName, DstAppName)\r\n| extend\r\n AppIDName = extract(@' (.*) --', 1, AppSignatureName), // this should be the name of the application in app control (already in the src/dst appname.)\r\n AppCategoryName = extract(@'^[\"]([a-zA-Z-]+)', 1, AppSignatureName)\r\n| extend\r\n AppSignatureName = trim('\"', extract(@'.*-- (.*\\S)', 1, AppSignatureName))\r\n| summarize Count = count() by AppSignatureID, AppSignatureName, AppIDName, AppCategoryName\r\n| top 25 by Count desc\r\n| project-reorder AppSignatureName", "size": 0, "showAnalytics": true, "title": "Top 25 Signatures Prevented", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "filter": true }, "tileSettings": { "titleContent": { "columnMatch": "AppSignatureName", "formatter": 1 }, "subtitleContent": { "columnMatch": "AppIDName", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "secondaryContent": { "columnMatch": "AppCategoryName" }, "showBorder": false } }, "customWidth": "50", "name": "query2ac", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n| where EventMessage == \"Application Control Detection Alert\"\r\n| extend\r\n AppSignatureName = coalesce(SrcAppName, DstAppName)\r\n| extend\r\n AppIDName = extract(@' (.*) --', 1, AppSignatureName), // this should be the name of the application in app control (already in the src/dst appname.)\r\n AppCategoryName = extract(@'^[\"]([a-zA-Z-]+)', 1, AppSignatureName)\r\n| extend\r\n AppSignatureName = trim('\"', extract(@'.*-- (.*\\S)', 1, AppSignatureName))\r\n| summarize Count = count() by Signature = AppSignatureName, Category = AppCategoryName, App = AppIDName\r\n| project-reorder Category, App, Signature\r\n| order by Count desc", "size": 0, "showAnalytics": true, "title": "App Control Detections by App and Signature", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true, "sortBy": [ { "itemKey": "Count", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "Count", "sortOrder": 2 } ] }, "customWidth": "60", "name": "query3ac", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n| where EventMessage == \"Application Control Detection Alert\"\r\n| extend\r\n AppSignatureName = coalesce(SrcAppName, DstAppName)\r\n| extend\r\n AppIDName = extract(@' (.*) --', 1, AppSignatureName), // this should be the name of the application in app control (already in the src/dst appname.)\r\n AppCategoryName = extract(@'^[\"]([a-zA-Z-]+)', 1, AppSignatureName)\r\n| summarize Count = count() by App = AppIDName, Category = AppCategoryName\r\n| project-reorder Category, App\r\n| order by Count desc", "size": 0, "showAnalytics": true, "title": "App Control Detections by App", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true, "sortBy": [ { "itemKey": "Count", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "Count", "sortOrder": 2 } ] }, "customWidth": "40", "name": "query4ac", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n| where EventMessage == \"Application Control Prevention Alert\"\r\n| extend\r\n AppSignatureName = coalesce(SrcAppName, DstAppName)\r\n| extend\r\n AppIDName = extract(@' (.*) --', 1, AppSignatureName), // this should be the name of the application in app control (already in the src/dst appname.)\r\n AppCategoryName = extract(@'^[\"]([a-zA-Z-]+)', 1, AppSignatureName)\r\n| extend\r\n AppSignatureName = trim('\"', extract(@'.*-- (.*\\S)', 1, AppSignatureName))\r\n| summarize Count = count() by Signature = AppSignatureName, Category = AppCategoryName, App = AppIDName\r\n| project-reorder Category, App, Signature\r\n| order by Count desc", "size": 0, "showAnalytics": true, "title": "App Control Preventions by App and Signature", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true } }, "customWidth": "60", "name": "query5ac", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n| where EventMessage == \"Application Control Prevention Alert\"\r\n| extend\r\n AppSignatureName = coalesce(SrcAppName, DstAppName)\r\n| extend\r\n AppIDName = extract(@' (.*) --', 1, AppSignatureName), // this should be the name of the application in app control (already in the src/dst appname.)\r\n AppCategoryName = extract(@'^[\"]([a-zA-Z-]+)', 1, AppSignatureName)\r\n| summarize Count = count() by App = AppIDName, Category = AppCategoryName\r\n| project-reorder Category, App\r\n| order by Count desc", "size": 0, "showAnalytics": true, "title": "App Control Preventions by App", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true } }, "customWidth": "40", "name": "query6ac", "styleSettings": { "showBorder": true } } ] }, "name": "ss-app-control", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Intrusion Prevention Service", "expandable": true, "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where Activity == \"IPS Detection Alert\"\r\n| parse-kv AdditionalExtensions as (['sid']:string, ['ipscat']:string, ['ipspri']:string) with (pair_delimiter=\";\", kv_delimiter=\"=\")\r\n| extend\r\n IPSPriority = case(ipspri == 1, \"High (1)\",\r\n ipspri == 2, \"Medium (2)\",\r\n ipspri == 3, \"Low (3)\",\r\n \"\"\r\n )\r\n| extend\r\n IPSCategoryName = extract(@'^\"?([a-zA-Z-\\/]+)', 1, ipscat),\r\n IPSSignatureName = extract(@'[ ](.*)\\S', 1, ipscat)\r\n| summarize Count = count() by IPSCategoryName, IPSPriority, IPSSignatureName\r\n| project-rename Priority = IPSPriority, Category = IPSCategoryName, Signature = IPSSignatureName\r\n", "size": 0, "showAnalytics": true, "title": "IPS Detections", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true } }, "customWidth": "50", "name": "query1ips", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where Activity == \"IPS Prevention Alert\"\r\n| parse-kv AdditionalExtensions as (['sid']:string, ['ipscat']:string, ['ipspri']:string) with (pair_delimiter=\";\", kv_delimiter=\"=\")\r\n| extend\r\n IPSPriority = case(ipspri == 1, \"High (1)\",\r\n ipspri == 2, \"Medium (2)\",\r\n ipspri == 3, \"Low (3)\",\r\n \"\"\r\n )\r\n| extend\r\n IPSCategoryName = extract(@'^\"?([a-zA-Z-\\/]+)', 1, ipscat),\r\n IPSSignatureName = extract(@'[ ](.*)\\S', 1, ipscat)\r\n| summarize Count = count() by IPSCategoryName, IPSPriority, IPSSignatureName\r\n| project-rename Priority = IPSPriority, Category = IPSCategoryName, Signature = IPSSignatureName\r\n", "size": 0, "showAnalytics": true, "title": "IPS Preventions", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true } }, "customWidth": "50", "name": "query2ips", "styleSettings": { "showBorder": true } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "7cbecf32-b9ea-497d-83a7-9b5f7f0a640a", "version": "KqlParameterItem/1.0", "name": "IPS_Action", "label": "IPS Action", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "jsonData": "[\r\n {\"value\": \"608\", \"label\": \"Detection/Logged\"},\r\n {\"value\": \"609\", \"label\": \"Prevention/Blocked\"}\r\n]", "timeContext": { "durationMs": 86400000 }, "defaultValue": "value::all", "value": [ "value::all" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\r\n\r\nCommonSecurityLog\r\n| where \"{SourceDevice:label}\" == \"All\" or Computer in ({SourceDevice})\r\n| where DeviceEventClassID in ({IPS_Action:value})\r\n| parse-kv AdditionalExtensions as (['sid']:string, ['ipscat']:string, ['ipspri']:string) with (pair_delimiter=\";\", kv_delimiter=\"=\")\r\n| extend\r\n IPSPriority = case(ipspri == 1, \"High (1)\",\r\n ipspri == 2, \"Medium (2)\",\r\n ipspri == 3, \"Low (3)\",\r\n \"\"\r\n )\r\n| extend\r\n IPSCategoryName = extract(@'^\"?([a-zA-Z-\\/]+)', 1, ipscat),\r\n IPSSignatureName = extract(@'[ ](.*)\\S', 1, ipscat)\r\n| extend Action = case(DeviceEventClassID == 608, \"Detection\", DeviceEventClassID == 609, \"Prevention\", \"\")\r\n| summarize by Time = TimeGenerated, Priority = IPSPriority, Category = IPSCategoryName, Signature = IPSSignatureName, SrcIP = SourceIP, SrcPort = SourcePort, DstIP = DestinationIP, DstPort = DestinationPort, Action\r\n| project-reorder Time, Action\r\n", "size": 0, "showAnalytics": true, "title": "IPS Detection/Prevention Details", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true } }, "name": "query3ipa", "styleSettings": { "showBorder": true } } ] }, "name": "ss-ips", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Anti-Spyware", "expandable": true, "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where Activity == \"Anti-Spyware Detection Alert\"\r\n| parse-kv AdditionalExtensions as (['sid']:string, ['catid']:string, ['spycat']:string, ['spypri']:string) with (pair_delimiter=\";\", kv_delimiter=\"=\")\r\n| extend\r\n AntiSpywareCategory = spycat,\r\n AntiSpywarePriority = case(spypri == 1, \"High (1)\",\r\n spypri == 2, \"Medium (2)\",\r\n spypri == 3, \"Low (3)\",\r\n \"\"\r\n )\r\n| summarize Count = count() by AntiSpywareCategory, AntiSpywarePriority\r\n| project-rename Category = AntiSpywareCategory, Priority = AntiSpywarePriority", "size": 0, "showAnalytics": true, "title": "Anti-Spyware Detections", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "query1asw", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where Activity == \"Anti-Spyware Prevention Alert\"\r\n| parse-kv AdditionalExtensions as (['sid']:string, ['catid']:string, ['spycat']:string, ['spypri']:string) with (pair_delimiter=\";\", kv_delimiter=\"=\")\r\n| extend\r\n AntiSpywareCategory = spycat,\r\n AntiSpywarePriority = case(spypri == 1, \"High (1)\",\r\n spypri == 2, \"Medium (2)\",\r\n spypri == 3, \"Low (3)\",\r\n \"\"\r\n )\r\n| summarize Count = count() by AntiSpywareCategory, AntiSpywarePriority\r\n| project-rename Category = AntiSpywareCategory, Priority = AntiSpywarePriority", "size": 0, "showAnalytics": true, "title": "Anti-Spyware Preventions", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "query2asw", "styleSettings": { "showBorder": true } } ] }, "name": "ss-antispyware", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Gateway Anti-Virus", "expandable": true, "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| where EventOriginalType in (809, 1462)\r\n| extend Message = tostring(AdditionalFields['EventMessageDetail'])\r\n| extend Threat = iff(Message contains \"Capture ATP detected virus\", \"Capture ATP Detection\", extract(@'.*\\) (.*) blocked.*', 1, Message))\r\n| extend ThreatURL = iff(Message contains \"URL:\", strcat('\"', extract(@'.*URL: (.*)', 1, Message)), \"\")\r\n| extend CloudAVID = iff(Message contains \"Cloud Id:\", extract(@'.*Cloud Id: (.*\\d)\\)', 1, Message), \"\")\r\n| summarize by Threat, Time = TimeGenerated, CloudAVID, SrcIP = SrcIpAddr, SrcPort = SrcPortNumber, DstIP = DstIpAddr, DstPort = DstPortNumber, ThreatURL\r\n| project-reorder Time, Threat", "size": 0, "showAnalytics": true, "title": "Gateway Anti-Virus Detailed Alerts {TimeRange}", "noDataMessageStyle": 3, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true } }, "name": "query1gav" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| where EventOriginalType in (809, 1462)\r\n| extend Message = tostring(AdditionalFields['EventMessageDetail'])\r\n| extend Threat = iff(Message contains \"Capture ATP detected virus\", \"Capture ATP Detection\", extract(@'.*\\) (.*) blocked.*', 1, Message))\r\n| extend ThreatDomain = iff(Message contains \"URL:\", strcat('\"', extract(@':\\/\\/([^\\/]+)\\/', 1, Message), '\"'), \"\")\r\n| extend CloudAVID = iff(Message contains \"Cloud Id:\", extract(@'.*Cloud Id: (.*\\d)\\)', 1, Message), \"\")\r\n| summarize Count = count() by Threat, CloudAVID, ThreatDomain\r\n| order by Count", "size": 0, "showAnalytics": true, "title": "Gateway Anti-Virus Alerts by Threat {TimeRange}", "noDataMessageStyle": 3, "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true } }, "customWidth": "40", "name": "query2gav", "styleSettings": { "showBorder": true } } ] }, "name": "ss-gav", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Capture ATP Insights", "expandable": true, "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "f3ca7626-b769-48ac-91d4-f7f32e80c832", "version": "KqlParameterItem/1.0", "name": "Capture_ATP_Verdict", "label": "File Verdict", "type": 2, "description": "Filter Capture ATP verdicts with this drop down", "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "All", "showDefault": false }, "jsonData": "[\r\n {\"value\": \"BAD\", \"label\": \"Malicious\"},\r\n {\"value\": \"GOOD\", \"label\": \"Benign\"},\r\n {\"value\": \"CloudAV Detection\", \"label\": \"CloudAV Detection\"}\r\n]", "timeContext": { "durationMs": 86400000 }, "defaultValue": "value::all", "value": [ "value::all" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceEventClassID in (1631, 1460)\r\n| extend Verdict = extract(@'Gateway Anti-Virus Status: (.*)\\. ', 1, Message)\r\n| where isnotempty(Verdict)\r\n| parse-kv AdditionalExtensions as (['arg']:string, ['susr']:string, ['fileid']:string) with (pair_delimiter=\";\", kv_delimiter=\"=\")\r\n| extend\r\n User = coalesce(susr, SourceUserName),\r\n NetworkProtocol = toupper(iff(Protocol contains \"-\" and Protocol !contains \"/\", toupper(trim_start(@\".*-\", Protocol)), toupper(trim_end(@\"/.*\", Protocol))))\r\n| project-rename \r\n Dvc = Computer,\r\n FileIdentifier = fileid,\r\n Url = RequestURL\r\n| extend File = split(Url, '/')[-1]\r\n| where \"{Capture_ATP_Verdict:lable}\" == \"All\" or Verdict in ({Capture_ATP_Verdict:value})\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| project Time = TimeGenerated, Dvc, User, NetworkProtocol, Verdict, Url, File, Hash = FileIdentifier\r\n| sort by Time desc", "size": 0, "showAnalytics": true, "title": "Verdicts from Capture ATP", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Time", "formatter": 6 } ], "filter": true, "sortBy": [ { "itemKey": "Time", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "Time", "sortOrder": 2 } ] }, "name": "query1catp", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceEventClassID in (1631, 1460)\r\n| extend Verdict = extract(@'Gateway Anti-Virus Status: (.*)\\. ', 1, Message)\r\n| where isnotempty(Verdict)\r\n| project-rename Dvc = Computer\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| summarize Count=count() by Verdict, bin(TimeGenerated, {TimeRange:grain})\r\n| sort by TimeGenerated desc\r\n| project-rename Date = TimeGenerated\r\n| project-reorder Date\r\n", "size": 0, "showAnalytics": true, "title": "Files Scanned over time", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "$gen_group", "formatter": 5, "dateFormat": { "showUtcTime": null, "formatName": "longDatePattern" } }, { "columnMatch": "Date", "formatter": 6, "dateFormat": { "showUtcTime": null, "formatName": "longDatePattern" } }, { "columnMatch": "Group", "formatter": 6, "dateFormat": { "showUtcTime": null, "formatName": "longDatePattern" } } ], "filter": true, "hierarchySettings": { "treeType": 1, "groupBy": [ "Date" ], "expandTopLevel": true } } }, "customWidth": "40", "name": "query2catp", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceEventClassID in (1631, 1460)\r\n| extend Verdict = extract(@'Gateway Anti-Virus Status: (.*)\\. ', 1, Message)\r\n| where isnotempty(Verdict)\r\n| project-rename \r\n Dvc = Computer\r\n| where \"{Capture_ATP_Verdict:lable}\" == \"All\" or Verdict in ({Capture_ATP_Verdict:value})\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| summarize LogVolume=count() by Verdict, bin_at(TimeGenerated, {TimeRange:grain}, {TimeRange:start})\r\n", "size": 1, "showAnalytics": true, "title": "Verdict Breakdown", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "GOOD", "label": "Benign", "color": "blue" }, { "seriesName": "File too big", "color": "orange" }, { "seriesName": "BAD", "label": "Malicious", "color": "redBright" }, { "seriesName": "CloudAV Detection", "color": "yellow" }, { "seriesName": "Server error. This firewall is sending packets too fast for it to reassemble.", "color": "turquoise" } ] } }, "customWidth": "50", "name": "query3catp", "styleSettings": { "showBorder": true } } ] }, "name": "capture-atp", "styleSettings": { "showBorder": true } } ] }, "name": "security-services", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Traffic and Events", "expandable": true, "items": [ { "type": 1, "content": { "json": "Additional traffic and event insights. Use the filters at the top of the workbook to adjust time ranges and more.", "style": "info" }, "name": "text - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| project-rename\r\n SrcZone = DeviceCustomString3Label,\r\n DstZone = DeviceCustomString4Label,\r\n DstIpAddr = DestinationIP,\r\n Dvc = Computer\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| extend NetworkDirection = case(SrcZone == \"\" and DstZone == \"\", \"NA\"\r\n , SrcZone == \"WAN\" and (DstZone == \"WAN\" and DstIpAddr !has \".255\"), \"Inbound\"\r\n , SrcZone == \"WAN\" and DstZone == \"WAN\", \"External\"\r\n , SrcZone == \"WAN\" and DstZone != \"WAN\", \"Inbound\"\r\n , SrcZone == \"VPN\" and DstZone == \"WAN\", \"Outbound\"\r\n , SrcZone == \"VPN\" and DstZone != \"WAN\", \"Inbound\"\r\n , DstZone == \"MULTICAST\", \"NA\"\r\n , DstZone == \"WAN\", \"Outbound\"\r\n , \"Local\"\r\n )\r\n| summarize TotalSentBytes = sum(SentBytes), TotalReceivedBytes = sum(ReceivedBytes) by NetworkDirection\r\n| extend TotalBytes = TotalSentBytes + TotalReceivedBytes\r\n| project NetworkDirection, TotalSentBytes, TotalReceivedBytes, TotalBytes\r\n| order by TotalBytes desc", "size": 4, "showAnalytics": true, "title": "Network Traffic by Direction ({TimeRange})", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "yAxis": [ "TotalBytes" ], "ySettings": { "numberFormatSettings": { "unit": 2, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } } } } }, "name": "query1te", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| project-rename\r\n SrcZone = DeviceCustomString3Label,\r\n DstZone = DeviceCustomString4Label,\r\n DstIpAddr = DestinationIP,\r\n Dvc = Computer\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| extend NetworkDirection = case(SrcZone == \"\" and DstZone == \"\", \"NA\"\r\n , SrcZone == \"WAN\" and (DstZone == \"WAN\" and DstIpAddr !has \".255\"), \"Inbound\"\r\n , SrcZone == \"WAN\" and DstZone == \"WAN\", \"External\"\r\n , SrcZone == \"WAN\" and DstZone != \"WAN\", \"Inbound\"\r\n , SrcZone == \"VPN\" and DstZone == \"WAN\", \"Outbound\"\r\n , SrcZone == \"VPN\" and DstZone != \"WAN\", \"Inbound\"\r\n , DstZone == \"MULTICAST\", \"NA\"\r\n , DstZone == \"WAN\", \"Outbound\"\r\n , \"Local\"\r\n )\r\n| summarize TotalSentBytes = sum(SentBytes), TotalReceivedBytes = sum(ReceivedBytes) by NetworkDirection\r\n| extend TotalBytes = TotalSentBytes + TotalReceivedBytes\r\n| project NetworkDirection, TotalSentBytes, TotalReceivedBytes, TotalBytes\r\n| order by TotalBytes desc", "size": 1, "showAnalytics": true, "title": "Bytes Transferred by Direction ({TimeRange})", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "TotalSentBytes", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } } }, { "columnMatch": "TotalReceivedBytes", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } } }, { "columnMatch": "TotalBytes", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": true, "maximumFractionDigits": 2 } } } ], "labelSettings": [ { "columnId": "NetworkDirection", "label": "Direction" }, { "columnId": "TotalSentBytes", "label": "Total Sent" }, { "columnId": "TotalReceivedBytes", "label": "Total Received" }, { "columnId": "TotalBytes", "label": "Total Transferred" } ] } }, "name": "query2te", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Events by Action\r\nASimNetworkSessionSonicWallFirewall\r\n| where \"{SourceDevice:lable}\" == \"All\" or Dvc in ({SourceDevice})\r\n| where \"{Source_IP:lable}\" == \"All\" or SrcIpAddr in ({Source_IP})\r\n| where \"{Destination_IP:lable}\" == \"All\" or DstIpAddr in ({Destination_IP})\r\n| summarize count() by Action = DvcAction\r\n| project-rename Count = count_", "size": 4, "showAnalytics": true, "title": "Events by Action ({TimeRange})", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query3te", "styleSettings": { "showBorder": true } } ] }, "customWidth": "40", "name": "te-group1", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| project-rename\r\n SrcIpAddr = SourceIP,\r\n Dvc = Computer\r\n| where \"{SourceDevice:label}\" == \"All\" or Dvc in ({SourceDevice})\r\n| summarize TotalSentBytes = sum(SentBytes), TotalReceivedBytes = sum(ReceivedBytes) by SrcIpAddr\r\n| extend TotalBytes = TotalSentBytes + TotalReceivedBytes\r\n| project SrcIpAddr, TotalSentBytes, TotalReceivedBytes, TotalBytes\r\n| order by TotalBytes desc\r\n| top 25 by TotalBytes", "size": 0, "showAnalytics": true, "title": "Top Sent/Received Bytes by IP ({TimeRange})", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "TotalSentBytes", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "TotalReceivedBytes", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "TotalBytes", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "SentReceivedRatio", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": true } } } ], "filter": true, "labelSettings": [ { "columnId": "TotalSentBytes", "label": "Sent" }, { "columnId": "TotalReceivedBytes", "label": "Received" }, { "columnId": "TotalBytes", "label": "Total" } ] } }, "customWidth": "30", "name": "query4te", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| project-rename Dvc = Computer\r\n| where \"{SourceDevice:label}\" == \"All\" or Dvc in ({SourceDevice})\r\n| summarize TotalSentBytes = sum(SentBytes), TotalReceivedBytes = sum(ReceivedBytes) by Protocol\r\n| extend TotalBytes = TotalSentBytes + TotalReceivedBytes\r\n| project Protocol, TotalSentBytes, TotalReceivedBytes, TotalBytes\r\n| order by TotalBytes desc\r\n| top 25 by TotalBytes", "size": 0, "showAnalytics": true, "title": "Top Sent/Received Bytes by Protocol ({TimeRange})", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "TotalSentBytes", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "TotalReceivedBytes", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "TotalBytes", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "SentReceivedRatio", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": true } } } ], "filter": true, "labelSettings": [ { "columnId": "TotalSentBytes", "label": "Sent" }, { "columnId": "TotalReceivedBytes", "label": "Received" }, { "columnId": "TotalBytes", "label": "Total" } ] } }, "customWidth": "30", "name": "query5te", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| project-rename\r\n Dvc = Computer,\r\n SrcIpAddr = SourceIP,\r\n DstIpAddr = DestinationIP\r\n| where \"{SourceDevice:label}\" == \"All\" or Dvc in ({SourceDevice})\r\n| summarize TotalSentBytes = sum(SentBytes), TotalReceivedBytes = sum(ReceivedBytes) by SrcIpAddr, DstIpAddr, Protocol\r\n| extend TotalBytes = TotalSentBytes + TotalReceivedBytes\r\n| project SrcIpAddr, DstIpAddr, Protocol, TotalSentBytes, TotalReceivedBytes, TotalBytes\r\n| order by TotalBytes desc\r\n| top 25 by TotalBytes", "size": 1, "showAnalytics": true, "title": "Top 25 Flows by Sent/Received Bytes ({TimeRange})", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "TotalSentBytes", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "TotalReceivedBytes", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "TotalBytes", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": true } } }, { "columnMatch": "SentReceivedRatio", "formatter": 0, "numberFormat": { "unit": 2, "options": { "style": "decimal", "useGrouping": true } } } ], "filter": true, "labelSettings": [ { "columnId": "TotalSentBytes", "label": "Sent" }, { "columnId": "TotalReceivedBytes", "label": "Received" }, { "columnId": "TotalBytes", "label": "Total" } ] } }, "customWidth": "50", "name": "query6te", "styleSettings": { "showBorder": true } } ] }, "name": "traffic-and-events", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Denied IPs and Ports", "expandable": true, "items": [ { "type": 1, "content": { "json": "A view of the top denied addresses and ports/protocols. Use the filters at the top of the workbook to adjust time ranges and more.\r\n\r\nThe Events refer to the Activity column of the CommonSecurityLog table.", "style": "info" }, "name": "text - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Top 10 denied inbound source IPs\r\nASimNetworkSessionSonicWallFirewall\r\n| where EventResult == \"Failure\" and NetworkDirection == \"Inbound\"\r\n| where \"{Destination_IP:lable}\" == \"All\" or DstIpAddr in ({Destination_IP})\r\n| summarize Events = makeset(EventMessage), DeniedCount = count() by SrcIpAddr, SrcZone\r\n| top 10 by DeniedCount desc", "size": 0, "showAnalytics": true, "title": "Top 10 Denied Inbound Source IP", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true, "sortBy": [ { "itemKey": "DeniedCount", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "DeniedCount", "sortOrder": 2 } ] }, "customWidth": "50", "name": "query1proto", "styleSettings": { "maxWidth": "50", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Top 10 denied outbound destination IPs\r\nASimNetworkSessionSonicWallFirewall\r\n| where EventResult == \"Failure\" and NetworkDirection == \"Outbound\"\r\n| where \"{Source_IP:lable}\" == \"All\" or SrcIpAddr in ({Source_IP})\r\n| summarize Events = makeset(EventMessage), DeniedCount = count() by DstIpAddr, DstZone\r\n| top 10 by DeniedCount desc", "size": 0, "showAnalytics": true, "title": "Top 10 Denied Outbound Destination IPs", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true } }, "customWidth": "50", "name": "query2proto", "styleSettings": { "maxWidth": "50", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Top 25 denied inbound ports\r\nASimNetworkSessionSonicWallFirewall\r\n| where EventResult == \"Failure\" and NetworkDirection == \"Inbound\"\r\n| where isnotempty(DstPortNumber)\r\n| where \"{Source_IP:lable}\" == \"All\" or SrcIpAddr in ({Source_IP})\r\n| where \"{Destination_IP:lable}\" == \"All\" or DstIpAddr in ({Destination_IP})\r\n| project-rename IPVersion = NetworkProtocolVersion, Port = DstPortNumber\r\n| summarize Events = makeset(EventMessage), DeniedCount = count() by Port, NetworkProtocol, IPVersion, SrcZone\r\n| top 25 by DeniedCount desc\r\n", "size": 0, "showAnalytics": true, "title": "Top 25 Denied Inbound Ports ({TimeRange})", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true } }, "customWidth": "50", "name": "query3proto", "styleSettings": { "maxWidth": "50", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Top 25 denied outbound ports\r\nASimNetworkSessionSonicWallFirewall\r\n| where EventResult == \"Failure\" and NetworkDirection == \"Outbound\"\r\n| where isnotempty(DstPortNumber)\r\n| where \"{Source_IP:lable}\" == \"All\" or SrcIpAddr in ({Source_IP})\r\n| where \"{Destination_IP:lable}\" == \"All\" or DstIpAddr in ({Destination_IP})\r\n| project-rename IPVersion = NetworkProtocolVersion, Port = DstPortNumber\r\n| summarize Events = makeset(EventMessage), DeniedCount = count() by Port, Protocol = NetworkProtocol, IPVersion, SrcZone\r\n| top 25 by DeniedCount desc", "size": 0, "showAnalytics": true, "title": "Top 25 Denied Outbound Ports", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "filter": true } }, "customWidth": "50", "name": "query4proto", "styleSettings": { "maxWidth": "50", "showBorder": true } } ] }, "name": "denied-ips-and-ports", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Trends, by time", "expandable": true, "items": [ { "type": 1, "content": { "json": "Various insights into hourly trends. Use the filters at the top of the workbook to adjust time ranges and more.", "style": "info" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\r\n| where DeviceVendor == 'SonicWall'\r\n| where \"{SourceDevice:lable}\"==\"All\" or Computer in ({SourceDevice})\r\n| where \"{Destination_IP:lable}\"==\"All\" or DestinationIP in ({Destination_IP})\r\n| where \"{Source_IP:lable}\" == \"All\" or SourceIP in ({Source_IP})\r\n| where \"{ActivitySelection:lable}\" == \"All\" or Activity in ({ActivitySelection})\r\n| summarize LogVolume=count() by Activity, bin_at(TimeGenerated, {TimeRange:grain}, {TimeRange:start})", "size": 0, "aggregation": 3, "title": "Activity by time ({TimeRange})", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "customWidth": "50", "name": "query1trends", "styleSettings": { "maxWidth": "50", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n| where \"{SourceDevice:lable}\"==\"All\" or Dvc in ({SourceDevice})\r\n| where \"{Destination_IP:lable}\"==\"All\" or DstIpAddr in ({Destination_IP})\r\n| where \"{Source_IP:lable}\" == \"All\" or SrcIpAddr in ({Source_IP})\r\n| where \"{ActivitySelection:lable}\" == \"All\" or EventMessage in ({ActivitySelection})\r\n| summarize LogVolume=count() by DvcAction, bin_at(TimeGenerated, {TimeRange:grain}, {TimeRange:start})", "size": 0, "aggregation": 3, "title": "Device Action by time ({TimeRange})", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "customWidth": "50", "name": "query2trends", "styleSettings": { "maxWidth": "50", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ASimNetworkSessionSonicWallFirewall\r\n| where \"{SourceDevice:lable}\"==\"All\" or Dvc in ({SourceDevice})\r\n| where \"{Destination_IP:lable}\"==\"All\" or DstIpAddr in ({Destination_IP})\r\n| where \"{Source_IP:lable}\" == \"All\" or SrcIpAddr in ({Source_IP})\r\n| where \"{ActivitySelection:lable}\" == \"All\" or EventMessage in ({ActivitySelection})\r\n| extend LogMsgSeverity = tostring(AdditionalFields['LogMsgSeverity'])\r\n| summarize LogVolume=count() by LogMsgSeverity, bin_at(TimeGenerated, {TimeRange:grain}, {TimeRange:start})", "size": 0, "aggregation": 3, "title": "Event Severity by time ({TimeRange})", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart" }, "customWidth": "50", "name": "query3trends", "styleSettings": { "maxWidth": "50", "showBorder": true } } ] }, "name": "trends", "styleSettings": { "showBorder": true } } ], "fallbackResourceIds": [], "fromTemplateId": "sentinel-SonicWallWorkbook1", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }