{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Subscription}" ], "parameters": [ { "id": "a4b4e975-fa7c-46a3-b669-850aacc88134", "version": "KqlParameterItem/1.0", "name": "Help", "label": "🔎 Getting Started", "type": 10, "isRequired": true, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Yes\", \"label\": \"Yes\", \"selected\":true},\r\n {\"value\": \"No\", \"label\": \"No\"}\r\n]" }, { "version": "KqlParameterItem/1.0", "name": "AzureLighthouse", "label": "🔦 Azure Lighthouse", "type": 10, "isRequired": true, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n {\"value\": \"Yes\", \"label\": \"Yes\", \"selected\":true},\r\n {\"value\": \"No\", \"label\": \"No\"}\r\n]", "value": "No", "id": "f298117c-71e2-4f0d-bdd0-a280ba262206" }, { "version": "KqlParameterItem/1.0", "name": "DefaultSubscription_Internal", "type": 1, "isRequired": true, "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| take 1\r\n| project subscriptionId", "crossComponentResources": [ "value::selected" ], "isHiddenWhenLocked": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "id": "314d02bf-4691-43fa-af59-d67073c8b8fa" }, { "id": "e6ded9a1-a83c-4762-938d-5bf8ff3d3d38", "version": "KqlParameterItem/1.0", "name": "Subscription", "type": 6, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)", "crossComponentResources": [ "value::all" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "defaultValue": "value::all", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "e3225ed0-6210-40a1-b2d0-66e42ffa71d6", "version": "KqlParameterItem/1.0", "name": "Workspace", "type": 5, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| order by name asc\r\n| summarize Selected = makelist(id, 10), All = makelist(id, 1000)\r\n| mvexpand All limit 100\r\n| project value = tostring(All), label = tostring(All), selected = iff(Selected contains All, true, false)", "crossComponentResources": [ "{Subscription}" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "defaultValue": "value::all", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": [ "value::all" ] }, { "id": "15b2c181-7397-43c1-900a-28e175ae8a6f", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "value": { "durationMs": 1209600000 }, "typeSettings": { "selectableValues": [ { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true } } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "Parameter Selectors" }, { "type": 1, "content": { "json": "  Please take time to answer a quick survey,\r\n[ click here. ](https://forms.office.com/r/tqe4bXUEXS)" }, "name": "Survey" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "managedservicesresources\r\n| where type == \"microsoft.managedservices/registrationassignments\"\r\n| where properties.provisioningState == \"Succeeded\"\r\n| extend ManageeTenantName = properties.registrationDefinition.properties.manageeTenantName\r\n| extend ManageeTenantId = properties.registrationDefinition.properties.manageeTenantId\r\n| extend ManagedByTenantName = properties.registrationDefinition.properties.managedByTenantName\r\n| extend ManagedByTenantId = properties.registrationDefinition.properties.managedByTenantId\r\n| extend PermanentAccess = properties.registrationDefinition.properties.authorizations\r\n| extend JITAccess = properties.registrationDefinition.properties.eligibleAuthorizations\r\n| extend AddedDate = properties.registrationDefinition.systemData.createdAt\r\n| extend CreatedBy = systemData.createdBy\r\n| project ManageeTenantName, ManageeTenantId, ManagedByTenantName, ManagedByTenantId, AddedDate, CreatedBy", "size": 4, "showAnalytics": true, "title": "Azure Lighthouse Delegations", "noDataMessage": "No Azure Lighthouse Delegations/Customers Detected", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "ManageeTenantName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Download", "text": "{0}{1}" } ] } }, { "columnMatch": "ManagedByTenantName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Upload", "text": "{0}{1}" } ] } }, { "columnMatch": "AddedDate", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Clock", "text": "{0}{1}" } ] } }, { "columnMatch": "PermanentAccess", "formatter": 1 }, { "columnMatch": "JITAccess", "formatter": 1 } ], "filter": true } }, "conditionalVisibility": { "parameterName": "AzureLighthouse", "comparison": "isEqualTo", "value": "Yes" }, "name": "query - 21 - Copy" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [IoT/OT Threat Monitoring with Defender for IoT](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/defending-critical-infrastructure-with-the-microsoft-sentinel-it/ba-p/3061184)\n---\n\nWelcome to the IoT/OT Threat Monitoring with Defender for IoT Workbook. \nThis workbook provides a guided investigation for entities based on open incidents, alerts sign-ins and activity for IT/OT assets. This workbook also provides hunting via MITRE ATT&CK® for ICS, and designed to enable SecOps Analysts, Security Engineers, and MSSPs to gain situational awareness for IT/OT security posture." }, "name": "Workbook Overview" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "nav", "links": [ { "id": "25558b22-8903-4bd8-84a0-a13b1e78fa86", "cellValue": "https://ms.portal.azure.com/#blade/Microsoft_Azure_IoT_Defender/IoTDefenderDashboard/Getting_started", "linkTarget": "Url", "linkLabel": "Get Started with Microsoft Defender for IoT", "style": "link" }, { "id": "1bad541e-219a-4277-9510-876b0e8cad51", "cellValue": "https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/defending-critical-infrastructure-with-the-microsoft-sentinel-it/ba-p/3061184", "linkTarget": "Url", "linkLabel": "Solution Blog", "style": "link" }, { "id": "b9a6293e-1c7b-4ec2-ad2a-d72b5ee01722", "cellValue": "https://youtu.be/hZS2aplJoy8", "linkTarget": "Url", "linkLabel": "Video Demo", "style": "link" }, { "id": "7e8ff8aa-f632-4a4d-90cf-a71da0dc6b31", "cellValue": "https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/IoTOTThreatMonitoringwithDefenderforIoT", "linkTarget": "Url", "linkLabel": "GitHub Repo", "style": "link" } ] }, "name": "links - 29" } ] }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "customWidth": "79", "name": "group - 10" }, { "type": 1, "content": { "json": "![Image Name](https://azure.microsoft.com/svghandler/azure-sentinel?width=600&height=300) " }, "conditionalVisibility": { "parameterName": "Help", "comparison": "isEqualTo", "value": "Yes" }, "customWidth": "20", "name": "Azure Defender for IoT Logo" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "1f801685-c900-4cf3-8d1b-7e5cfff7672d", "cellValue": "TAB", "linkTarget": "parameter", "linkLabel": "Overview", "subTarget": "overview", "style": "link" }, { "id": "b837a8d0-17c3-4da1-a6f2-7662b00ffd06", "cellValue": "TAB", "linkTarget": "parameter", "linkLabel": "Device Inventory", "subTarget": "inventory", "style": "link" }, { "id": "94d4ab9a-4ec7-4e4b-a69d-b6acb5cccd62", "cellValue": "TAB", "linkTarget": "parameter", "linkLabel": "Incidents", "subTarget": "incidents", "style": "link" }, { "id": "18c690d7-7cbd-46c1-b677-1f72692d40cd", "cellValue": "TAB", "linkTarget": "parameter", "linkLabel": "Alerts", "subTarget": "alerts", "preText": "Alert rules", "style": "link" }, { "id": "a514cac2-c3b0-43d9-8491-a89a0e9157d3", "cellValue": "TAB", "linkTarget": "parameter", "linkLabel": "MITRE ATT&CK® for ICS", "subTarget": "mitre", "style": "link" }, { "id": "3d0357c5-671a-49af-95a1-096c0e988e6e", "cellValue": "TAB", "linkTarget": "parameter", "linkLabel": "Vulnerabilities", "subTarget": "vulnerabilities", "style": "link" } ] }, "name": "Tabs link" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Alerts](https://docs.microsoft.com/azure/defender-for-iot/organizations/alert-engine-messages)" }, "name": "text - 0" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "🟦 Alerts Summary", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources \n | where type=='microsoft.iotsecurity/locations/devicegroups/alerts' \n | extend TimeFirstSeen=properties.startTimeUtc\n | where TimeFirstSeen {TimeRange}\n | where properties.status != \"Closed\"\n | where properties.severity == \"High\"\n | summarize AlertCount2=count() ", "size": 4, "title": "HIGH", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "AlertCount2", "formatter": 12, "formatOptions": { "palette": "hotCold" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "size": "auto" } }, "customWidth": "12", "name": "query - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources \n | where type=='microsoft.iotsecurity/locations/devicegroups/alerts' \n | extend TimeFirstSeen=properties.startTimeUtc\n | where TimeFirstSeen {TimeRange}\n | where properties.status != \"Closed\"\n | where properties.severity == \"Medium\"\n | summarize AlertCount2=count() ", "size": 4, "title": "MEDIUM", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "AlertCount2", "formatter": 12, "formatOptions": { "max": 0, "palette": "orange" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, "showBorder": false, "size": "auto" } }, "customWidth": "12", "name": "query - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources \n | where type=='microsoft.iotsecurity/locations/devicegroups/alerts' \n | extend TimeFirstSeen=properties.startTimeUtc\n | where TimeFirstSeen {TimeRange}\n | where properties.status != \"Closed\"\n | where properties.severity == \"Low\"\n | summarize AlertCount2=count() ", "size": 4, "title": "LOW", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "AlertCount2", "formatter": 12, "formatOptions": { "max": 0, "palette": "yellow" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "size": "auto" } }, "customWidth": "12", "name": "query - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources \n | where type=='microsoft.iotsecurity/locations/devicegroups/alerts' \n | extend TimeFirstSeen=properties.startTimeUtc\n | where TimeFirstSeen >= ago(1d)\n | where properties.status != \"Closed\"\n | summarize AlertCount2=count() ", "size": 4, "title": "NEW TODAY", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "AlertCount2", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "size": "auto" } }, "customWidth": "12", "name": "query - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources \n | where type=='microsoft.iotsecurity/locations/devicegroups/alerts' \n | extend TimeFirstSeen=properties.startTimeUtc\n | where TimeFirstSeen {TimeRange}\n | where properties.status != \"Closed\"\n | where properties.severity == \"High\"\n | summarize AlertCount2=count() by tostring(properties.displayName)\n | sort by AlertCount2\n | take 250", "size": 0, "showAnalytics": true, "title": "TOP HIGH SEVERITY ALERTS", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "gridSettings": { "formatters": [ { "columnMatch": "properties_displayName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "Count", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "AlertLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Alert >" } }, { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "warning", "text": "{0}{1}" } ] } }, { "columnMatch": "Recommendation", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Recommendation >" } }, { "columnMatch": "RecommendationClick", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Click to Recommendation" } }, { "columnMatch": "RecommendationLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Recommendation >" } } ], "filter": true, "labelSettings": [ { "columnId": "properties_displayName", "label": "Alert Name", "comment": "" }, { "columnId": "AlertCount2", "label": "Count" } ] } }, "customWidth": "50", "name": "Security Alerts over Time" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources \n | where type=='microsoft.iotsecurity/locations/devicegroups/alerts' \n | extend TimeFirstSeen=properties.startTimeUtc\n | where TimeFirstSeen {TimeRange}\n | summarize AlertCount=count() by bin(todatetime(TimeFirstSeen), 1d), tostring(properties.severity)\n", "size": 0, "showAnalytics": true, "title": "TRENDING", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "timechart", "gridSettings": { "formatters": [ { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "Count", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "AlertLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Alert >" } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "warning", "text": "{0}{1}" } ] } }, { "columnMatch": "Recommendation", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Recommendation >" } }, { "columnMatch": "RecommendationClick", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Click to Recommendation" } }, { "columnMatch": "RecommendationLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Recommendation >" } } ] }, "chartSettings": { "xAxis": "TimeFirstSeen", "yAxis": [ "AlertCount" ], "group": "properties_severity", "createOtherGroup": 0, "showLegend": true, "seriesLabelSettings": [ { "seriesName": "", "label": "Alert Count" } ] } }, "name": "query - 6" } ] }, "name": "🟦 Alerts Summary" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "🟦 Location", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources \n | where type=='microsoft.iotsecurity/locations/devicegroups/alerts' \n | extend TimeFirstSeen=properties.startTimeUtc\n | where TimeFirstSeen {TimeRange}\n | mv-expand deviceEntities=properties.entities\n | extend AlertDeviceName = tostring(deviceEntities.DeviceName)\n | extend AlertID=tostring(properties.systemAlertId)\n | join kind=leftouter (iotsecurityresources \n | where type=='microsoft.iotsecurity/locations/devicegroups/devices' \n | where isnotnull(properties.sensor.site)\n | extend Site=tostring(properties.sensor.site)\n | extend DeviceName = tostring(properties.deviceName)\n | project Site, DeviceName) on $left.AlertDeviceName == $right.DeviceName\n | where DeviceName != \"\"\n | summarize AlertCount=dcount(AlertID) by Site\n | take 20\n\n", "size": 3, "title": "Alerts by Site", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "piechart" }, "customWidth": "33", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources \n | where type=='microsoft.iotsecurity/locations/devicegroups/alerts' \n | extend TimeFirstSeen=properties.startTimeUtc\n | where TimeFirstSeen {TimeRange}\n | mv-expand deviceEntities=properties.entities\n | extend AlertDeviceName = tostring(deviceEntities.DeviceName)\n | extend AlertID=tostring(properties.systemAlertId)\n | join kind=leftouter (iotsecurityresources \n | where type=='microsoft.iotsecurity/locations/devicegroups/devices' \n | where isnotnull(properties.sensor.zone)\n | extend Zone=tostring(properties.sensor.zone)\n | extend DeviceName = tostring(properties.deviceName)\n | project Zone, DeviceName) on $left.AlertDeviceName == $right.DeviceName\n | where DeviceName != \"\"\n | summarize AlertCount=dcount(AlertID) by Zone\n | take 20\n\n", "size": 3, "title": "Alerts by Zone", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "piechart" }, "customWidth": "33", "name": "query - 0 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources \n| where type=='microsoft.iotsecurity/locations/devicegroups/alerts' \n| extend TimeFirstSeen=properties.startTimeUtc\n| where TimeFirstSeen {TimeRange}\n| extend SensorId_ = tostring(properties.extendedProperties.SensorId)\n| where isnotempty(SensorId_)\n| summarize count() by SensorId_\n| sort by count_ desc", "size": 3, "showAnalytics": true, "title": "Alerts by Sensor", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "piechart", "gridSettings": { "formatters": [ { "columnMatch": "SensorId_", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "ShowItems", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Address_", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "", "text": "{0}{1}" } ] } }, { "columnMatch": "Vendor_", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "PowerUp", "text": "{0}{1}" } ] } }, { "columnMatch": "DeviceType_", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "2", "text": "{0}{1}" } ] } } ], "filter": true, "labelSettings": [ { "columnId": "SensorId_", "label": "Sensor" }, { "columnId": "count_", "label": "Count" } ] } }, "customWidth": "33", "name": "query - 7 - Copy - Copy - Copy" } ] }, "name": "🟦 Alerts Summary - Copy" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "🟦 Alert Count", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources \n | where type=='microsoft.iotsecurity/locations/devicegroups/alerts' \n | extend TimeFirstSeen=properties.startTimeUtc\n | where TimeFirstSeen {TimeRange}\n | summarize kwSum=count() by tostring(properties.productComponentName)\n | sort by kwSum\n", "size": 1, "showAnalytics": true, "title": "⬇️ SELECTOR", "exportMultipleValues": true, "exportedParameters": [ { "parameterName": "_sensorengine", "parameterType": 1 }, { "parameterType": 1 } ], "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "kwSum", "formatter": 3, "formatOptions": { "palette": "coldHot", "compositeBarSettings": { "labelText": "", "columnSettings": [ { "columnName": "kwSum", "color": "blue" } ] } } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15%" } }, { "columnMatch": "s_engine", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } } ], "labelSettings": [ { "columnId": "properties_productComponentName", "label": "Alert Engine" }, { "columnId": "kwSum", "label": "Total Alerts" } ] }, "tileSettings": { "subtitleContent": { "columnMatch": "ProductComponentName" }, "secondaryContent": { "columnMatch": "kwSum" }, "showBorder": false }, "graphSettings": { "type": 2, "topContent": { "columnMatch": "ProductComponentName" }, "centerContent": { "columnMatch": "kwSum" }, "nodeIdField": "kwSum", "graphOrientation": 3, "showOrientationToggles": false, "staticNodeSize": 100, "colorSettings": { "nodeColorField": "kwSum", "type": 4, "heatmapPalette": "greenRed", "emptyValueColor": "gray" }, "hivesMargin": 5 }, "chartSettings": { "yAxis": [ "kwSum" ], "showMetrics": false, "showLegend": true, "seriesLabelSettings": [ { "seriesName": "Critical", "color": "red" }, { "seriesName": "Major", "color": "orange" }, { "seriesName": "Warning", "color": "green" } ] } }, "customWidth": "30", "name": "setEngine", "styleSettings": { "maxWidth": "30" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources \n | where type=='microsoft.iotsecurity/locations/devicegroups/alerts' \n | extend TimeFirstSeen=properties.startTimeUtc\n | extend AlertSeverity=tostring(properties.severity)\n | extend Status=tostring(properties.status)\n | extend Engine=tostring(properties.productComponentName)\n | where TimeFirstSeen {TimeRange}\n | where tostring('{_sensorengine}') has Engine or isempty(dynamic('{_sensorengine}'))\n | summarize kwSum=count() by AlertSeverity\n | sort by AlertSeverity asc\n", "size": 1, "showAnalytics": true, "title": "SEVERITY", "exportMultipleValues": true, "exportedParameters": [ { "parameterName": "p_engine", "parameterType": 1 }, { "parameterType": 1 } ], "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "piechart", "gridSettings": { "formatters": [ { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15%" } }, { "columnMatch": "s_engine", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } } ], "filter": true }, "tileSettings": { "showBorder": false }, "graphSettings": { "type": 0 }, "chartSettings": { "yAxis": [ "kwSum" ], "showMetrics": false, "showLegend": true, "seriesLabelSettings": [ { "seriesName": "High", "color": "red" }, { "seriesName": "Low", "color": "green" }, { "seriesName": "Medium", "color": "orange" } ] } }, "customWidth": "20", "name": "Severity" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources \n | where type=='microsoft.iotsecurity/locations/devicegroups/alerts' \n | extend TimeFirstSeen=properties.startTimeUtc\n | extend AlertSeverity=tostring(properties.severity)\n | extend Engine=tostring(properties.productComponentName)\n | where TimeFirstSeen {TimeRange}\n | where tostring('{_sensorengine}') has Engine or isempty(dynamic('{_sensorengine}'))\n | where tostring('{p_engine}') has AlertSeverity or isempty('{p_engine}')\n | summarize event_count=count() by bin(todatetime(TimeFirstSeen), 1d)\n", "size": 1, "showAnalytics": true, "title": "TRENDING", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ], "visualization": "timechart", "gridSettings": { "formatters": [ { "columnMatch": "kwSum", "formatter": 3, "formatOptions": { "palette": "blue", "compositeBarSettings": { "labelText": "" } } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15%" } }, { "columnMatch": "s_engine", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } } ] }, "tileSettings": { "showBorder": false }, "graphSettings": { "type": 0 }, "chartSettings": { "xAxis": "TimeFirstSeen", "yAxis": [ "event_count" ], "group": "event_count", "createOtherGroup": null, "seriesLabelSettings": [ { "seriesName": "", "label": "Alert Count" } ], "showDataPoints": true, "xSettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } } } }, "customWidth": "50", "name": "setEngine", "styleSettings": { "maxWidth": "40" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources \n| where type=='microsoft.iotsecurity/locations/devicegroups/alerts' \n| extend TimeFirstSeen=properties.startTimeUtc\n| where TimeFirstSeen {TimeRange}\n| mv-expand deviceEntities=properties.entities\n| extend deviceType = tostring(deviceEntities.DeviceType)\n| where isnotempty(deviceType)\n| where deviceType != \"Unclassified\"\n| summarize count() by deviceType\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "DEVICE_TYPE", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "gridSettings": { "formatters": [ { "columnMatch": "deviceType", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "ResourceFlat", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "DeviceType_", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "2", "text": "{0}{1}" } ] } } ], "filter": true, "labelSettings": [ { "columnId": "deviceType", "label": "Device Type" }, { "columnId": "count_", "label": "Count" } ] } }, "customWidth": "33", "name": "query - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources \n| where type=='microsoft.iotsecurity/locations/devicegroups/alerts' \n| extend TimeFirstSeen=properties.startTimeUtc\n| where TimeFirstSeen {TimeRange}\n| mv-expand deviceEntities=properties.entities\n| extend deviceVendor = tostring(deviceEntities.Vendor)\n| where isnotempty(deviceVendor)\n| summarize count() by deviceVendor\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "VENDOR", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "deviceVendor", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "PowerUp", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "redBright" } } ], "filter": true, "labelSettings": [ { "columnId": "deviceVendor", "label": "Device Vendor" }, { "columnId": "count_", "label": "Count" } ] } }, "customWidth": "33", "name": "query - 7 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources \n| where type=='microsoft.iotsecurity/locations/devicegroups/alerts' \n| extend TimeFirstSeen=properties.startTimeUtc\n| where TimeFirstSeen {TimeRange}\n| mv-expand deviceEntities=properties.entities\n| extend deviceName = tostring(deviceEntities.DeviceName)\n| extend deviceLink = tostring(deviceEntities.DevicePageLink)\n| where isnotempty(deviceName)\n| summarize count() by deviceName, deviceLink\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Affected Devices", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "deviceName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "", "text": "{0}{1}" } ] } }, { "columnMatch": "deviceLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": ">> Link", "customColumnWidthSetting": "20ch" } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Address_", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "", "text": "{0}{1}" } ] } }, { "columnMatch": "Vendor_", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "PowerUp", "text": "{0}{1}" } ] } }, { "columnMatch": "DeviceType_", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "2", "text": "{0}{1}" } ] } } ], "filter": true, "labelSettings": [ { "columnId": "deviceName", "label": "Device Name" }, { "columnId": "deviceLink", "label": "Deivce Page Link" }, { "columnId": "count_", "label": "Count" } ] } }, "customWidth": "33", "name": "query - 7" } ] }, "name": "🟦 Alerts Count", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources \n| where type=='microsoft.iotsecurity/locations/devicegroups/alerts' \n| extend TimeFirstSeen=properties.startTimeUtc\n| where TimeFirstSeen {TimeRange}\n| extend AlertName = tostring(properties.displayName)\n| extend AlertSeverity = tostring(properties.severity)\n| extend Status = tostring(properties.status)\n| extend Tactics = tostring(properties.intent)\n| extend data = split(id, '/')\n| extend type = tostring(properties.alertType)\n| extend StringforBase64function = strcat('{\"alertType\":\"', type, '\",\"location\":\"', data[6], '\",\"deviceGroupName\":\"', data[8], '\",\"alertId\":\"', data[10], '\",\"subscriptionId\":\"', data[2], '\"}')\n| extend alertlink = base64_encode_tostring(StringforBase64function)\n| extend SeverityRank = iff(AlertSeverity == \"High\", 3, iff(AlertSeverity == \"Medium\", 2, iff(AlertSeverity == \"Low\", 1, iff(AlertSeverity == \"Informational\", 0, 0))))\n| sort by SeverityRank, todatetime(TimeFirstSeen) \n| project TimeFirstSeen, AlertName, AlertSeverity, Tactics, Status, AlertLink=strcat(\"https://portal.azure.com/#view/Microsoft_Azure_IoT_Defender/IAlertBlade/data/\",alertlink)\n| take 50", "size": 0, "showAnalytics": true, "title": "🟦 Recent Security Alerts", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeFirstSeen", "formatter": 6, "dateFormat": { "formatName": "shortDateTimePattern" } }, { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "2", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "Sev0", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "Sev1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "Sev2", "text": "{0}{1}" }, { "operator": "Default", "representation": "Sev3", "text": "{0}{1}" } ] } }, { "columnMatch": "ProductName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "uninitialized", "text": "{0}{1}" } ] } }, { "columnMatch": "AlertLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Alert >>" } }, { "columnMatch": "UPN", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "2", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Incident >" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "blue" } }, { "columnMatch": "city_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "state_", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "representation": "blueDark", "text": "{0}{1}" } ] } } ], "filter": true, "labelSettings": [ { "columnId": "TimeFirstSeen", "label": "Time First Seen" }, { "columnId": "AlertName", "label": "Alert Name" }, { "columnId": "AlertSeverity", "label": "Alert Severity" } ] }, "tileSettings": { "titleContent": { "columnMatch": "SigninStatus", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 9, "formatOptions": { "palette": "green" } }, "showBorder": false }, "mapSettings": { "locInfo": "CountryRegion", "locInfoColumn": "Location", "latitude": "SourceIPLocation", "longitude": "SourceIPLocation", "sizeSettings": "Location", "sizeAggregation": "Count", "legendMetric": "Location", "legendAggregation": "Count", "itemColorSettings": { "nodeColorField": "Location", "colorAggregation": "Count", "type": "thresholds", "thresholdsGrid": [ { "operator": "Default", "representation": "blueDark" } ] } } }, "name": "🟦 Security Alerts: Go To >", "styleSettings": { "showBorder": true } } ] }, "name": "OT Alerts" } ] }, "conditionalVisibility": { "parameterName": "TAB", "comparison": "isEqualTo", "value": "alerts" }, "name": "Alerts" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# [Incidents](https://docs.microsoft.com/azure/sentinel/investigate-cases)" }, "name": "text - 0" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "🟦 Incidents Summary", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| where TimeGenerated {TimeRange}\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\" or Title contains \"(MDIoT)\"\n| where Severity == \"High\" and Status != \"Closed\"\n| summarize kwSum=dcount(ProviderIncidentId)\n\n\n\n\n", "size": 4, "title": "HIGH", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "kwSum", "formatter": 12, "formatOptions": { "palette": "hotCold" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "size": "auto" } }, "customWidth": "12", "name": "query - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\" or Title contains \"(MDIoT)\"\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\n| where Status == \"Active\"\n| summarize kwSum=dcount(ProviderIncidentId)\n\n\n\n\n", "size": 4, "title": "ACTIVE", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "kwSum", "formatter": 12, "formatOptions": { "min": 0, "max": 1, "palette": "orange" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "size": "auto" } }, "customWidth": "12", "name": "query - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\" or Title contains \"(MDIoT)\"\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\n| where Status == \"Closed\"\n| summarize kwSum=dcount(ProviderIncidentId)\n\n\n\n", "size": 4, "title": "CLOSED", "noDataMessage": "No unauthorized devices making config changes", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "kwSum", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "size": "auto" } }, "customWidth": "12", "name": "query - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\" or Title contains \"(MDIoT)\"\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\n| where TimeGenerated > ago(1d)\n| summarize kwSum=dcount(ProviderIncidentId)\n\n\n\n", "size": 4, "title": "NEW TODAY", "noDataMessage": "No unauthorized devices making config changes", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "kwSum", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "size": "auto" } }, "customWidth": "12", "name": "query - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\r\n| where ProductName contains \"iot\" or Title contains \"(MDIoT)\"\r\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\r\n| where Severity == \"High\"\r\n| summarize count() by Title\r\n| sort by count_ desc\r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "TOP HIGH SEVERITY INCIDENTS", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "Count", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "AlertLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Alert >" } }, { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "warning", "text": "{0}{1}" } ] } }, { "columnMatch": "Recommendation", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Recommendation >" } }, { "columnMatch": "RecommendationClick", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Click to Recommendation" } }, { "columnMatch": "RecommendationLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Recommendation >" } } ], "filter": true } }, "customWidth": "50", "name": "Security Alerts over Time" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\r\n| where ProductName contains \"iot\" or Title contains \"(MDIoT)\"\r\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\r\n| where Severity == \"High\"\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by Title\r\n| render timechart\r\n", "size": 0, "showAnalytics": true, "title": "HIGH SEVERITY TRENDING", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "AlertName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Fired", "text": "{0}{1}" } ] } }, { "columnMatch": "Count", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "AlertLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Alert >" } }, { "columnMatch": "count_", "formatter": 8, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "warning", "text": "{0}{1}" } ] } }, { "columnMatch": "Recommendation", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Recommendation >" } }, { "columnMatch": "RecommendationClick", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Click to Recommendation" } }, { "columnMatch": "RecommendationLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Go to Recommendation >" } } ] } }, "name": "Security Alerts over Time - Copy" } ] }, "name": "group - 3 - Copy" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "🟦 Location", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| extend SystemAlertId = tostring(AlertIds[0])\n| join (SecurityAlert) on SystemAlertId\n| mv-expand deviceEntities=parse_json(Entities)\n| extend deviceSite = tostring(deviceEntities.Site)\n| where isnotempty(deviceSite) \n| summarize AlertCount=dcount(ProviderIncidentId) by deviceSite \n| sort by AlertCount desc", "size": 3, "showAnalytics": true, "title": "SITE", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart", "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ], "filter": true }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "kwSum", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "size": "auto" }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Low", "color": "yellow" }, { "seriesName": "Medium", "color": "orange" }, { "seriesName": "High", "color": "redBright" }, { "seriesName": "Informational", "color": "blue" } ] } }, "customWidth": "33", "name": "query - 3 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| extend SystemAlertId = tostring(AlertIds[0])\n| join (SecurityAlert) on SystemAlertId\n| mv-expand deviceEntities=parse_json(Entities)\n| extend deviceZone = tostring(deviceEntities.Zone)\n| where isnotempty(deviceZone) \n| summarize AlertCount=dcount(ProviderIncidentId) by deviceZone\n| sort by AlertCount\n| limit 20 ", "size": 3, "showAnalytics": true, "title": "ZONE", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart", "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ], "filter": true }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "kwSum", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "size": "auto" }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Low", "color": "yellow" }, { "seriesName": "Medium", "color": "orange" }, { "seriesName": "High", "color": "redBright" }, { "seriesName": "Informational", "color": "blue" } ] } }, "customWidth": "33", "name": "query - 3 - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| extend SystemAlertId = tostring(AlertIds[0])\n| join (SecurityAlert) on SystemAlertId\n| extend sensorID = tostring(parse_json(ExtendedProperties).SensorId)\n| where isnotempty(sensorID) \n| summarize count() by sensorID\n| sort by count_ desc\n| limit 20 ", "size": 3, "showAnalytics": true, "title": "SENSOR", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart", "gridSettings": { "formatters": [ { "columnMatch": "sensorID", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, "representation": "ShowItems", "text": "{0}{1}" } ] } }, { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ], "filter": true, "labelSettings": [ { "columnId": "sensorID", "label": "Sensor ID" }, { "columnId": "count_", "label": "Count" } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "kwSum", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "size": "auto" }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Low", "color": "yellow" }, { "seriesName": "Medium", "color": "orange" }, { "seriesName": "High", "color": "redBright" }, { "seriesName": "Informational", "color": "blue" } ] } }, "customWidth": "33", "name": "query - 3 - Copy" } ] }, "name": "site/zone/sensor" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "🟦 Efficiency", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\" or Title contains \"(MDIoT)\"\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\n| summarize dcount(ProviderIncidentId) by Severity\n| render piechart\n\n\n", "size": 3, "showAnalytics": true, "title": "SEVERITY", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "kwSum", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "size": "auto" }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Low", "color": "yellow" }, { "seriesName": "Medium", "color": "orange" }, { "seriesName": "High", "color": "redBright" }, { "seriesName": "Informational", "color": "blue" } ] } }, "customWidth": "25", "name": "query - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\r\n| where ProductName contains \"iot\" or Title contains \"(MDIoT)\"\r\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\r\n| where Status == 'Closed'\r\n| extend feedback =strcat(Classification,\" \",ClassificationReason)\r\n| summarize dcount(IncidentNumber) by feedback\r\n", "size": 3, "showAnalytics": true, "title": "CLOSE CODES", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "kwSum", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "size": "auto" }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Low", "color": "yellow" }, { "seriesName": "Medium", "color": "orange" }, { "seriesName": "High", "color": "redBright" }, { "seriesName": "Informational", "color": "blue" } ] } }, "customWidth": "25", "name": "query - 6" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\" or Title contains \"(MDIoT)\"\n| summarize arg_max(LastModifiedTime,*) by IncidentNumber \n| extend TimeToTriage = (FirstModifiedTime - CreatedTime)/1h\n| summarize 50th_Percentile=percentile(TimeToTriage, 50) \n", "size": 1, "showAnalytics": true, "title": "MEAN TIME TO RESPOND", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "50th_Percentile", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 26, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 3 } } }, "showBorder": false, "size": "auto" } }, "customWidth": "50", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\" or Title contains \"(MDIoT)\"\n| summarize arg_max(TimeGenerated,*) by IncidentNumber \n| extend TimeToResolve = (ClosedTime - CreatedTime)/1d\n| summarize 50th_Percentile=percentile(TimeToResolve, 50)", "size": 1, "showAnalytics": true, "title": "MEAN TIME TO RESOLVE", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Classification", "formatter": 1 }, "leftContent": { "columnMatch": "50th_Percentile", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 26, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 3 } } }, "showBorder": false, "size": "auto" } }, "customWidth": "50", "name": "query - 2" } ] }, "customWidth": "50", "name": "Mean times " } ] }, "name": "group - 3", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "🟦 Incidents", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\" or Title contains \"(MDIoT)\"\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\n| extend SystemAlertId = tostring(AlertIds[0])\n| join (SecurityAlert) on SystemAlertId\n| extend IPAddress = tostring(parse_json(tostring(parse_json(Entities)[0].IpAddress)).Address)\n| where CompromisedEntity <> \"\"\n| summarize count() by CompromisedEntity\n| where CompromisedEntity has \".\"\n| sort by count_ desc\n| limit 250 \n\n", "size": 0, "showAnalytics": true, "title": "IP ADDRESS", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ], "filter": true }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "kwSum", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "size": "auto" }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Low", "color": "yellow" }, { "seriesName": "Medium", "color": "orange" }, { "seriesName": "High", "color": "redBright" }, { "seriesName": "Informational", "color": "blue" } ] } }, "customWidth": "25", "name": "query - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\" or Title contains \"(MDIoT)\"\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\n| extend SystemAlertId = tostring(AlertIds[0])\n| join (SecurityAlert) on SystemAlertId\n| extend Protocol = tostring(parse_json(ExtendedProperties).Protocol)\n| where Protocol != \"\"\n| summarize count() by Protocol\n| sort by count_ desc\n| limit 250", "size": 0, "showAnalytics": true, "title": "PROTOCOL", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ], "filter": true }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "kwSum", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "size": "auto" }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Low", "color": "yellow" }, { "seriesName": "Medium", "color": "orange" }, { "seriesName": "High", "color": "redBright" }, { "seriesName": "Informational", "color": "blue" } ] } }, "customWidth": "25", "name": "query - 7 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\" or Title contains \"(MDIoT)\"\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\n| extend SystemAlertId = tostring(AlertIds[0])\n| join (SecurityAlert) on SystemAlertId\n| mv-expand deviceEntities=parse_json(Entities)\n| extend deviceType = tostring(deviceEntities.DeviceType)\n| where isnotempty(deviceType) and deviceType!=\"Unclassified\"\n| summarize count() by deviceType\n| sort by count_ desc\n| limit 20 ", "size": 0, "showAnalytics": true, "title": "DEVICE TYPE", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ], "filter": true }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "kwSum", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "size": "auto" }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Low", "color": "yellow" }, { "seriesName": "Medium", "color": "orange" }, { "seriesName": "High", "color": "redBright" }, { "seriesName": "Informational", "color": "blue" } ] } }, "customWidth": "25", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\" or Title contains \"(MDIoT)\"\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\n| extend SystemAlertId = tostring(AlertIds[0])\n| join (SecurityAlert) on SystemAlertId\n| mv-expand deviceEntities=parse_json(Entities)\n| extend Vendor = tostring(deviceEntities.Vendor)\n| where Vendor <> \"\"\n| summarize count() by Vendor\n| sort by count_ desc\n| limit 250 ", "size": 0, "showAnalytics": true, "title": "VENDOR", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "count_", "formatter": 4, "formatOptions": { "palette": "yellowOrangeRed" } }, { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ], "filter": true }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "kwSum", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": false, "size": "auto" }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Low", "color": "yellow" }, { "seriesName": "Medium", "color": "orange" }, { "seriesName": "High", "color": "redBright" }, { "seriesName": "Informational", "color": "blue" } ] } }, "customWidth": "25", "name": "query - 3 - Copy" } ] }, "name": "group - 4", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "🟦 Security Incidents: Go To >", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\r\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\r\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\r\n| where ProductName contains \"iot\" or Title contains \"(MDIoT)\"\r\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\r\n| parse IncidentUrl with * '/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, ProductName, FirstActivityTime, IncidentBlade\r\n| limit 250", "size": 0, "showAnalytics": true, "noDataMessage": "No Incidents Observed Within These Thresholds", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Incident Name", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Alert", "text": "{0}{1}" } ] } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "Sev0", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "Sev1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "Sev2", "text": "{0}{1}" }, { "operator": "Default", "representation": "Sev3", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "Incident >>", "bladeOpenContext": { "bladeName": "CaseBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [ { "name": "id", "source": "column", "value": "IncidentBlade" } ] } } }, { "columnMatch": "ProductName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "Default", "representation": "Execution", "text": "{0}{1}" } ] } }, { "columnMatch": "IncidentBlade", "formatter": 5 } ], "filter": true } }, "name": "query - 3" } ] }, "name": "group - 2", "styleSettings": { "showBorder": true } } ] }, "name": "OT Incidents" } ] }, "conditionalVisibility": { "parameterName": "TAB", "comparison": "isEqualTo", "value": "incidents" }, "name": "Incidents" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## 💡 [MITRE ATT&CK® for ICS](https://collaborate.mitre.org/attackics/index.php/Main_Page)\r\n----------------------------------------------------------------------------------------------------" }, "name": "text - 77" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where Tactics contains \"Initial\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Initial_Access\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Initial Access" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 79", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where Tactics contains \"Execution\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Execution\")\n\n\n", "size": 4, "showAnalytics": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Execution" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 79", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where Tactics contains \"Persistence\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Persistence\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Persistence" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 79", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where Tactics contains \"Privilege\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Privilege_Escalation\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Privilege Escalation" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 79", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where Tactics contains \"Evasion\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Evasion\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Evasion" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 79", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where Tactics contains \"Discovery\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Discovery\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Discovery" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 79", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where Tactics contains \"Lateral\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Lateral_Movement\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Lateral Movement" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 79", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where Tactics contains \"Collection\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Collection\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Collection" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 79 - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where Tactics contains \"Command\" or Tactics contains \"Function\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Command_and_Control\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "C2 & IRF" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 79 - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where Tactics contains \"Impact\" or Tactics contains \"Process\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Impact\")\n\n\n", "size": 4, "showAnalytics": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "IPC & Impact" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 79 - Copy - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "## 💡 [Techniques](https://collaborate.mitre.org/attackics/index.php/Main_Page)\r\n----------------------------------------------------------------------------------------------------" }, "name": "text - 12" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0817\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0817\")\n\n\n", "size": 4, "showAnalytics": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Drive-by Compromise" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0858\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0858\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Change Operating Mode" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0889\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0889\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Modify Program" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0874\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0874\")\n\n\n", "size": 4, "showAnalytics": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Hooking" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0858\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0858\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Change Operating Mode" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0842\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0842\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Network Sniffing" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0874T0812\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0812\")\n\n\n", "size": 4, "showAnalytics": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Default Credentials" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0811\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0811\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Data from Information Repositories" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0885\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0885\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Commonly Used Port" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0806\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0806\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Brute Force I/O" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0866\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0866\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Exploitation of Remote Services" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0807\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0807\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Command-Line Interface" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0839\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0839\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Module Firmware" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 28" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0849\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0849\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Masquerading" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0846\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0846\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Remote System Discovery" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0866\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0866\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Exploitation of Remote Services" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0801\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0801\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Monitor Process State" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0884\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0884\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Connection Proxy" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0836\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0836\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Modify Parameter" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0822\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0822\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "External Remote Services" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0871\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0871\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Execution through API" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0857\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0857\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "System Firmware" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 42" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0851\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0851\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Rootkit" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 42 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0867\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0867\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Lateral Tool Transfer" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0861\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0861\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Point & Tag Identification" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0869\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0869\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Standard Application Layer Protocol" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0839\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0839\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Module Firmware" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0883\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0883\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Internet Accessible Device" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0874\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0874\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Hooking" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0859\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0859\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Valid Accounts" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "" }, "customWidth": "30", "name": "text - 93" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0843\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0843\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Program Download" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0845\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0845\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Program Upload" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0803\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0803\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Block Command Message" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0855\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0855\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Unauthorized Command Message" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0886\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0886\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Remote Services" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0821\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0821\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Modify Controller Tasking" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "" }, "customWidth": "40", "name": "text - 70" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0886\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0886\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Remote Services" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 71" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0809\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0809\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Data Destruction" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0826\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0826\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Loss of Availability" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0847\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0847\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Replication Through Removable Media" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0863\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0863\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "User Execution" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "" }, "customWidth": "40", "name": "text - 72" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0859\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0859\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Valid Accounts" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 74" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0814\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0814\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Denial of Service" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0828\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0828\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Loss of Productivity and Revenue" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0848\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0848\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Rogue Master" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "" }, "customWidth": "70", "name": "text - 75" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0816\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0816\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Device Restart/Shutdown" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0831\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0831\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Manipulation of Control" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0865\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0865\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Spearphishing Attachment" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "" }, "customWidth": "70", "name": "text - 76" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0838\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0838\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Modify Alarm Settings" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0882\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0882\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Theft of Operational Information" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "" }, "customWidth": "80", "name": "text - 78" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0881\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0881\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Service Stop" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 79" }, { "type": 1, "content": { "json": "" }, "customWidth": "80", "name": "text - 80" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| where AdditionalData contains \"T0857\"\n| summarize count()\n| extend Link = strcat(\"https://collaborate.mitre.org/attackics/index.php/Technique/T0857\")\n\n\n", "size": 4, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Description", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "60%" } }, { "columnMatch": "name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "5%" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "critical", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Major", "representation": "2", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ], "customColumnWidthSetting": "5" } }, { "columnMatch": "message", "formatter": 7, "formatOptions": { "linkTarget": "CellDetails", "linkIsContextBlade": true, "customColumnWidthSetting": "70%" } } ] }, "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 8, "formatOptions": { "min": 0, "palette": "greenRed" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "secondaryContent": { "columnMatch": "Link", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "System Firmware" } }, "showBorder": false, "size": "auto" } }, "customWidth": "10", "name": "query - 78", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "" }, "customWidth": "10", "name": "text - 81" } ] }, "name": "ICS Matrix Chart" } ] }, "conditionalVisibility": { "parameterName": "TAB", "comparison": "isEqualTo", "value": "mitre" }, "name": "MITRE ATT&CK® for ICS" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Vulnerabilities" }, "name": "text - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Subscription}" ], "parameters": [ { "id": "da5915bc-62e7-4cb5-9178-66868f38367d", "version": "KqlParameterItem/1.0", "name": "SiteName", "label": "Site", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/devices\"\n| extend Site=properties.sensor.site\n| where Site != \"\"\n| summarize by tostring(Site)", "crossComponentResources": [ "{Subscription}" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "defaultValue": "value::all", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "ec6ab0e8-d7b7-4398-ab08-25257aa4c968", "version": "KqlParameterItem/1.0", "name": "SeverityName", "label": "Severity", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/vulnerabilities\"\n| extend Severity=properties.severityScore\n| summarize by tostring(Severity)", "crossComponentResources": [ "{Subscription}" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "defaultValue": "value::all", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parameters - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/vulnerabilities\"\n| extend DeviceID = tostring(properties.deviceId)\n\n| extend severity=properties['severityScore']\n| extend Severity=properties.severityScore\n| where Severity in ({SeverityName})\n| join kind=leftouter (iotsecurityresources\n | where type=='microsoft.iotsecurity/locations/devicegroups/devices'\n | project DeviceSiteName=tostring(properties.sensor.site), name) on $left.DeviceID == $right.name\n| where DeviceSiteName in ({SiteName})\n| summarize count() by tostring(severity )\n", "size": 3, "title": "CVE by Severity", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "piechart", "tileSettings": { "titleContent": { "columnMatch": "vendor", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false, "sortCriteriaField": "count_", "sortOrderField": 2 }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "High", "color": "redBright" }, { "seriesName": "Medium", "color": "orange" }, { "seriesName": "Critical", "color": "red" }, { "seriesName": "Low", "color": "yellow" } ] } }, "customWidth": "33", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " iotsecurityresources\n | where type == \"microsoft.iotsecurity/locations/devicegroups/vulnerabilities\"\n | extend severity=properties['severityScore'],\n deviceId=tostring(properties['deviceId']),\n score=properties['score'],\n cveName = properties['vulnerabilityId'],\n cveDes=properties['description']\n | project deviceId\n | join  kind=leftouter (iotsecurityresources\n          | where type=='microsoft.iotsecurity/locations/devicegroups/devices'\n          | project Site=tostring(properties.sensor.site), name) on $left.deviceId == $right.name\n | where Site in ({SiteName})\n | summarize count() by Site\n | project site = iff(Site==\"\", \"Managed IoT Hub\", Site), count_\n", "size": 3, "title": "CVE by Site", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "piechart" }, "customWidth": "33", "name": "query - 7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/vulnerabilities\"\n| extend DeviceID = tostring(properties.deviceId)\n| extend severity=properties['severityScore'],\n deviceId=tostring(properties['deviceId']),\n score=properties['score'],\n cveName = properties['vulnerabilityId'],\n cveDes=properties['description']\n| mv-expand components=properties['affectedComponents'] \n| extend vendor=components['vendor'],\n version=components['version'],\n type=components['type'],\n product=components['product']\n| extend Severity=properties.severityScore\n| where Severity in ({SeverityName})\n| join kind=leftouter (iotsecurityresources\n | where type=='microsoft.iotsecurity/locations/devicegroups/devices'\n | project DeviceSiteName=tostring(properties.sensor.site), name) on $left.DeviceID == $right.name\n| where DeviceSiteName in ({SiteName})\n| summarize count() by tostring(cveName), tostring(vendor) \n| summarize count() by tostring(vendor) \n| where vendor != '*'", "size": 3, "title": "CVE by Vendor", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "piechart", "tileSettings": { "titleContent": { "columnMatch": "vendor", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": false, "sortCriteriaField": "count_", "sortOrderField": 2 } }, "customWidth": "33", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/vulnerabilities\"\n| extend DeviceID = tostring(properties.deviceId)\n| extend severity=properties['severityScore'],\n deviceId=tostring(properties['deviceId']),\n score=properties['score'],\n cveName = properties['vulnerabilityId'],\n cveDes=properties['description']\n| extend Severity=properties.severityScore\n| where Severity in ({SeverityName})\n| join kind=leftouter (iotsecurityresources\n | where type=='microsoft.iotsecurity/locations/devicegroups/devices'\n | project DeviceSiteName=tostring(properties.sensor.site), name) on $left.DeviceID == $right.name\n| where DeviceSiteName in ({SiteName})\n| summarize count() by tostring(cveName), tostring(cveDes), tostring(severity), tostring(score)\n| sort by count_\n| project cveName, cveDes, severity, score, count_", "size": 0, "showAnalytics": true, "title": "CVEs", "exportFieldName": "cveName", "exportParameterName": "pCveName", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "table", "showExpandCollapseGrid": true, "gridSettings": { "formatters": [ { "columnMatch": "cveDes", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "40ch" } }, { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "redDark", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "score", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "11ch" } }, { "columnMatch": "count_", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "18ch" } } ], "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "count_", "sortOrder": 2 } ], "labelSettings": [ { "columnId": "cveName", "label": "CVE Name" }, { "columnId": "cveDes", "label": "CVE Description" }, { "columnId": "severity", "label": "Severity" }, { "columnId": "score", "label": "Score" }, { "columnId": "count_", "label": "Devices Count" } ] }, "sortBy": [ { "itemKey": "count_", "sortOrder": 2 } ], "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "cveName", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "cveName", "formatter": 1 }, "centerContent": { "columnMatch": "count_", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "count_", "sizeAggregation": "Sum", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "count_", "heatmapPalette": "greenRed" } } }, "customWidth": "50", "name": "query - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/vulnerabilities\"\n| extend severity=properties['severityScore'],\n deviceId=tostring(properties['deviceId']),\n score=properties['score'],\n cveName = properties['vulnerabilityId'],\n cveDes=properties['description']\n| where severity in ({SeverityName})\n| where cveName == \"{pCveName}\"\n| join  kind=leftouter (iotsecurityresources\n         | where type=='microsoft.iotsecurity/locations/devicegroups/devices'\n         | project Site=tostring(properties.sensor.site), name, criticality=properties.criticality, deviceName=properties.deviceName) on $left.deviceId == $right.name\n| extend site = iff(Site==\"\", \"Managed IoT Hub\", Site)\n| where site in ({SiteName})\n| project deviceId, tostring(deviceName), site\n", "size": 0, "showAnalytics": true, "title": "Selected CVE - Affected Devices", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "table", "showExpandCollapseGrid": true, "gridSettings": { "formatters": [ { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "redDark", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } } ], "rowLimit": 10000, "filter": true }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "cveName", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "cveName", "formatter": 1 }, "centerContent": { "columnMatch": "count_", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "count_", "sizeAggregation": "Sum", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "count_", "heatmapPalette": "greenRed" } } }, "customWidth": "50", "name": "query - 11 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/vulnerabilities\"\n| extend DeviceID = tostring(properties.deviceId)\n| extend severity=properties['severityScore'],\n deviceId=tostring(properties['deviceId']),\n score=properties['score'],\n cveName = properties['vulnerabilityId'],\n cveDes=properties['description']\n| extend Severity=properties.severityScore\n| where Severity in ({SeverityName})\n| join kind=leftouter (iotsecurityresources\n | where type=='microsoft.iotsecurity/locations/devicegroups/devices'\n | extend DeviceName = tostring(properties.deviceName)\n | project DeviceSiteName=tostring(properties.sensor.site), name, DeviceName) on $left.DeviceID == $right.name\n| join kind=leftouter\n (iotsecurityresources \n | where type=='microsoft.iotsecurity/locations/devicegroups/alerts' \n | where properties.status != \"Closed\"\n | extend name3= tostring(properties.extendedProperties.SourceDeviceAddress)\n | summarize AlertCount=count() by name3) on $left.DeviceName == $right.name3 \n| join kind=leftouter\n (iotsecurityresources \n | where type=='microsoft.iotsecurity/locations/devicegroups/alerts' \n | where properties.status != \"Closed\"\n | where tostring(properties.extendedProperties.DestinationDeviceAddress)!=tostring(properties.extendedProperties.SourceDeviceAddress)\n | summarize AlertCount2=count() by name4=tostring(properties.extendedProperties.DestinationDeviceAddress)) on $left.DeviceName == $right.name4 \n| where DeviceSiteName in ({SiteName})\n| summarize Total = count(), Critical = countif(tostring(severity) == \"Critical\"), High = countif(tostring(severity) == \"High\"), Medium = countif(tostring(severity) == \"Medium\"), Low = countif(tostring(severity) == \"Low\") by deviceId, DeviceName, DeviceSiteName, AlertCountSum=coalesce(AlertCount,0)+coalesce(AlertCount2,0)\n| sort by Total", "size": 0, "showAnalytics": true, "title": "Vulnerable Devices", "exportFieldName": "deviceId", "exportParameterName": "pDeviceId", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "table", "showExpandCollapseGrid": true, "gridSettings": { "formatters": [ { "columnMatch": "DeviceName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "17ch" } }, { "columnMatch": "DeviceSiteName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "10ch" } }, { "columnMatch": "AlertCountSum", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "16ch" } }, { "columnMatch": "Total", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "14ch" } }, { "columnMatch": "Critical", "formatter": 8, "formatOptions": { "palette": "redDark" } }, { "columnMatch": "High", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Medium", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "Low", "formatter": 8, "formatOptions": { "palette": "yellow" } } ], "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "Total", "sortOrder": 2 } ], "labelSettings": [ { "columnId": "deviceId", "label": "Device ID" }, { "columnId": "DeviceName", "label": "Device Name" }, { "columnId": "DeviceSiteName", "label": "Site" }, { "columnId": "AlertCountSum", "label": "Open Alerts" }, { "columnId": "Total", "label": "Total CVEs" }, { "columnId": "Critical", "label": "Critical" }, { "columnId": "High", "label": "High" }, { "columnId": "Medium", "label": "Medium" }, { "columnId": "Low", "label": "Low" } ] }, "sortBy": [ { "itemKey": "Total", "sortOrder": 2 } ], "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "tenantId", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "50", "name": "query - 13" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/vulnerabilities\"\n| extend severity=properties['severityScore'],\n deviceId=tostring(properties['deviceId']),\n score=properties['score'],\n cveName = properties['vulnerabilityId'],\n cveDes=properties['description']\n| where severity in ({SeverityName})\n| where deviceId == \"{pDeviceId}\"\n| join  kind=leftouter (iotsecurityresources\n         | where type=='microsoft.iotsecurity/locations/devicegroups/devices'\n         | project Site=tostring(properties.sensor.site), name, criticality=properties.criticality, deviceName=properties.deviceName) on $left.deviceId == $right.name\n| extend site = iff(Site==\"\", \"Managed IoT Hub\", Site)\n| where site in ({SiteName})\n| project tostring(cveName), tostring(severity),tostring(score), tostring(cveDes)\n| order by score\n", "size": 0, "showAnalytics": true, "title": "Selected Device - Related CVEs", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "table", "showExpandCollapseGrid": true, "gridSettings": { "formatters": [ { "columnMatch": "severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "redDark", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "DeviceName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "17ch" } }, { "columnMatch": "DeviceSiteName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "10ch" } }, { "columnMatch": "AlertCountSum", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "16ch" } }, { "columnMatch": "Total", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "14ch" } }, { "columnMatch": "Critical", "formatter": 8, "formatOptions": { "palette": "redDark" } }, { "columnMatch": "High", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Medium", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "Low", "formatter": 8, "formatOptions": { "palette": "yellow" } } ], "rowLimit": 10000, "filter": true, "labelSettings": [ { "columnId": "cveName", "label": "CVE Name" }, { "columnId": "severity", "label": "Severity" }, { "columnId": "score", "label": "Score" }, { "columnId": "cveDes", "label": "CVE Description" } ] }, "sortBy": [], "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "tenantId", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "50", "name": "query - 13 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/vulnerabilities\"\n| extend DeviceID = tostring(properties.deviceId)\n| extend severity=properties['severityScore'],\n deviceId=tostring(properties['deviceId']),\n score=properties['score'],\n cveName = properties['vulnerabilityId'],\n cveDes=properties['description']\n| mv-expand components=properties['affectedComponents'] \n| extend vendor=components['vendor'],\n version=components['version'],\n type=components['type'],\n product=components['product']\n| extend Severity=properties.severityScore\n| where Severity in ({SeverityName})\n| join kind=leftouter (iotsecurityresources\n | where type=='microsoft.iotsecurity/locations/devicegroups/devices'\n | project DeviceSiteName=tostring(properties.sensor.site), name) on $left.DeviceID == $right.name\n| where DeviceSiteName in ({SiteName})\n| summarize by tostring(cveName), tostring(vendor), tostring(version),tostring(type), tostring(product), tostring(severity)\n|summarize Total = count(), Critical = countif(tostring(severity) == \"Critical\"), High = countif(tostring(severity) == \"High\"), Medium = countif(tostring(severity) == \"Medium\"), Low = countif(tostring(severity) == \"Low\") by tostring(product), tostring(vendor), tostring(version),tostring(type)\n| sort by Total\n", "size": 0, "title": "Vulnerable Components", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "vendor", "parameterName": "pVendor", "parameterType": 1 }, { "fieldName": "version", "parameterName": "pVersion", "parameterType": 1 }, { "fieldName": "product", "parameterName": "pProduct", "parameterType": 1 } ], "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "table", "showExpandCollapseGrid": true, "gridSettings": { "formatters": [ { "columnMatch": "product", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "33ch" } }, { "columnMatch": "vendor", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" } }, { "columnMatch": "version", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15ch" } }, { "columnMatch": "Critical", "formatter": 8, "formatOptions": { "palette": "redDark" } }, { "columnMatch": "High", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Medium", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "Low", "formatter": 8, "formatOptions": { "palette": "yellow" } } ], "rowLimit": 10000, "filter": true, "labelSettings": [ { "columnId": "product", "label": "Component" }, { "columnId": "vendor", "label": "Vendor" }, { "columnId": "version", "label": "Version" }, { "columnId": "type", "label": "Type" }, { "columnId": "Total", "label": "Total CVEs" } ] }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "tenantId", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "50", "name": "query - 12" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/vulnerabilities\"\n| extend severity=properties['severityScore'],\n deviceId=tostring(properties['deviceId']),\n score=properties['score'],\n cveName = properties['vulnerabilityId'],\n cveDes=properties['description']\n| where severity in ({SeverityName})\n| mv-expand components=properties['affectedComponents'] \n| extend vendor=components['vendor'],\n version=components['version'],\n type=components['type'],\n product=components['product']\n| where product == \"{pProduct}\" and version==\"{pVersion}\" and vendor==\"{pVendor}\"\n| join  kind=leftouter (iotsecurityresources\n         | where type=='microsoft.iotsecurity/locations/devicegroups/devices'\n         | project Site=tostring(properties.sensor.site), name, criticality=properties.criticality, deviceName=properties.deviceName) on $left.deviceId == $right.name\n| extend site = iff(Site==\"\", \"Managed IoT Hub\", Site)\n| where site in ({SiteName})\n| project deviceId, tostring(deviceName), site\n| summarize by deviceId, deviceName, site\n", "size": 0, "title": "Selected Component - Affected Devices", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "vendor", "parameterName": "pVendor", "parameterType": 1 }, { "fieldName": "version", "parameterName": "pVersion", "parameterType": 1 }, { "fieldName": "product", "parameterName": "pProduct", "parameterType": 1 } ], "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "table", "showExpandCollapseGrid": true, "gridSettings": { "formatters": [ { "columnMatch": "product", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "33ch" } }, { "columnMatch": "vendor", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" } }, { "columnMatch": "version", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15ch" } }, { "columnMatch": "Critical", "formatter": 8, "formatOptions": { "palette": "redDark" } }, { "columnMatch": "High", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Medium", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "Low", "formatter": 8, "formatOptions": { "palette": "yellow" } } ], "rowLimit": 10000, "filter": true }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "tenantId", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "50", "name": "query - 12 - Copy" } ] }, "conditionalVisibility": { "parameterName": "TAB", "comparison": "isEqualTo", "value": "vulnerabilities" }, "customWidth": "100", "name": "Vulnerabilities" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# OT Device Inventory\n\n" }, "name": "text - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Subscription}" ], "parameters": [ { "id": "89842b77-826e-4175-a637-b02e09c8922c", "version": "KqlParameterItem/1.0", "name": "SiteName", "label": "Site", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/devices\"\n| extend Site=properties.sensor.site\n| where Site != \"\"\n| summarize by tostring(Site)", "crossComponentResources": [ "{Subscription}" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "defaultValue": "value::all", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "a42d8f71-272c-4579-aa69-350d125a2752", "version": "KqlParameterItem/1.0", "name": "ZoneName", "label": "Zone", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/devices\"\n| extend Zone=properties.sensor.zone\n| where Zone != \"\"\n| summarize by tostring(Zone)", "crossComponentResources": [ "{Subscription}" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "defaultValue": "value::all", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "4abc6f47-2ff6-47be-a921-75cb2ee546b1", "version": "KqlParameterItem/1.0", "name": "SensorName", "label": "Sensor", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/devices\"\n| extend Sensor=properties.sensor.name\n| where Sensor!=\"\"\n| summarize by tostring(Sensor)", "crossComponentResources": [ "{Subscription}" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "defaultValue": "value::all", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parameters - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/devices\"\n| extend DeviceName=tostring(properties.deviceName)\n| extend Sensor=tostring(properties.sensor.name)\n| extend Site=tostring(properties.sensor.site)\n| extend tostring(Zone=properties.sensor.zone)\n| where Sensor in ({SensorName}, \"\")\n| where Zone in ({ZoneName}, \"\")\n| where Site in ({SiteName}, \"\")\n| summarize CountDevices=count(DeviceName)\n", "size": 3, "title": "Total Devices", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "secondaryContent": { "columnMatch": "CountDevices", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": false, "size": "auto" } }, "customWidth": "12", "name": "query - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/devices\"\n| extend TimeFirstSeen=properties.lastSeen\n| where TimeFirstSeen {TimeRange}\n| extend DeviceName=tostring(properties.deviceName)\n| extend Sensor=tostring(properties.sensor.name)\n| extend Site=tostring(properties.sensor.site)\n| extend tostring(Zone=properties.sensor.zone)\n| where Sensor in ({SensorName})\n| where Zone in ({ZoneName})\n| where Site in ({SiteName})\n| summarize CountDevices=count(DeviceName)\n", "size": 3, "title": "Active Devices {TimeRange}", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "secondaryContent": { "columnMatch": "CountDevices", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": false, "size": "auto" } }, "customWidth": "12", "name": "query - 11 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/devices\"\n| extend TimeFirstSeen=properties.lastSeen\n| where TimeFirstSeen > ago(1d)\n| extend DeviceName=tostring(properties.deviceName)\n| extend Zone=tostring(properties.sensor.zone)\n| extend Site=properties.sensor.site\n| extend Sensor=properties.sensor.name\n| where Sensor in ({SensorName})\n| where Site in ({SiteName})\n| where Zone in ({ZoneName})\n| summarize CountDevices=count(DeviceName)\n", "size": 3, "title": "Active Devices Today", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "secondaryContent": { "columnMatch": "CountDevices", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": false, "size": "auto" } }, "customWidth": "12", "name": "query - 11 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/devices\"\n| extend TimeFirstSeen=properties.lastSeen\n| where TimeFirstSeen > ago(1d)\n| extend DeviceName=tostring(properties.deviceName)\n| extend Criticiality = tostring(properties.criticality)\n| extend Zone=tostring(properties.sensor.zone)\n| extend Site=properties.sensor.site\n| extend Sensor=properties.sensor.name\n| where Sensor in ({SensorName})\n| where Site in ({SiteName})\n| where Zone in ({ZoneName})\n| where Criticiality == \"High\"\n| summarize CountDevices=count(DeviceName)\n", "size": 3, "title": "High Importance Devices", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "secondaryContent": { "columnMatch": "CountDevices", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": false, "size": "auto" } }, "customWidth": "40", "name": "query - 11 - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " iotsecurityresources\n | where type == \"microsoft.iotsecurity/locations/devicegroups/devices\"\n | extend TimeFirstSeen=properties.lastSeen \n | where TimeFirstSeen {TimeRange}\n | extend DeviceName=properties.deviceName\n | extend Zone=tostring(properties.sensor.zone)\n | extend Site=properties.sensor.site\n | extend Sensor=properties.sensor.name\n | where Sensor in ({SensorName})\n | where Site in ({SiteName})\n | where Zone in ({ZoneName})\n | where properties.deviceDataSource=='OtSensor'\n | summarize count() by trim( @'^\\[\"|\"]$|\"', tostring(Site))", "size": 3, "title": "Active Devices by Site", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "piechart", "graphSettings": { "type": 0, "topContent": { "columnMatch": "Column1", "formatter": 1 }, "centerContent": { "columnMatch": "count_", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "33", "name": " Discovered OT devices by date - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " iotsecurityresources\n | where type == \"microsoft.iotsecurity/locations/devicegroups/devices\"\n | extend TimeFirstSeen=properties.lastSeen \n | where TimeFirstSeen {TimeRange}\n | extend DeviceName=properties.deviceName\n | extend Zone=tostring(properties.sensor.zone)\n | extend Site=properties.sensor.site\n | extend Sensor=properties.sensor.name\n | where Sensor in ({SensorName})\n | where Site in ({SiteName})\n | where Zone in ({ZoneName})\n | where properties.deviceDataSource=='OtSensor'\n | summarize count() by trim( @'^\\[\"|\"]$|\"', tostring(Zone))", "size": 3, "title": "Active Devices by Zone", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "piechart", "graphSettings": { "type": 0, "topContent": { "columnMatch": "Column1", "formatter": 1 }, "centerContent": { "columnMatch": "count_", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "33", "name": " Discovered OT devices by date - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " iotsecurityresources\n | where type == \"microsoft.iotsecurity/locations/devicegroups/devices\"\n | extend TimeFirstSeen=properties.lastSeen \n | where TimeFirstSeen {TimeRange}\n | extend DeviceName=properties.deviceName\n | extend Zone=tostring(properties.sensor.zone)\n | extend Site=properties.sensor.site\n | extend Sensor=properties.sensor.name\n | where Sensor in ({SensorName})\n | where Site in ({SiteName})\n | where Zone in ({ZoneName})\n | where properties.deviceDataSource=='OtSensor'\n | summarize count() by trim( @'^\\[\"|\"]$|\"', tostring(Sensor))", "size": 3, "title": "Active Devices by Sensor", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "piechart", "graphSettings": { "type": 0, "topContent": { "columnMatch": "Column1", "formatter": 1 }, "centerContent": { "columnMatch": "count_", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "33", "name": " Discovered OT devices by date - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " iotsecurityresources\n | where type == \"microsoft.iotsecurity/locations/devicegroups/devices\"\n | extend TimLastSeen=properties.lastSeen\n | extend DeviceName=properties.deviceName\n | where TimLastSeen {TimeRange}\n | extend Sensor=properties.sensor.name\n | where Sensor in ({SensorName})\n | extend DeviceSubType=iff(properties.deviceSubTypeDisplayName==\"Unclassified\", \"\", properties.deviceSubTypeDisplayName)\n | extend Site=properties.sensor.site\n | where Site in ({SiteName})\n | extend Zone=tostring(properties.sensor.zone)\n | where Zone in ({ZoneName})\n | extend IPv4=properties.nics.[0].ipv4Address\n | extend MACAddress=properties.nics.[0].macAddress\n | extend Vendor=properties.hardware.vendor\n | extend PurdueLevel=properties.purdueLevel\n | extend OperatingSystem=properties.operatingSystem.platform\n | extend Protocols = trim(@'^\\[\"|\"]$|\"', tostring(properties.protocols))\n | where properties.deviceDataSource=='OtSensor'\n | extend data=split(id, '/')\n | extend StringforBase64function = strcat('{\"subscriptionId\":\"', data[2], '\",\"deviceId\":\"', data[10], '\",\"location\":\"', data[6], '\",\"deviceGroupName\":\"', data[8], '\"}')\n | extend devicelink = base64_encode_tostring(StringforBase64function)\n | project TimLastSeen, tostring(DeviceName),DeviceLink=strcat(\"https://portal.azure.com/#view/Microsoft_Azure_IoT_Defender/IDeviceBlade/data/\",devicelink), tostring(DeviceSubType), tostring(Site), tostring(Zone), tostring(Sensor),tostring(PurdueLevel), tostring(IPv4), tostring(MACAddress), Protocols, tostring(Vendor), tostring(OperatingSystem), DeviceID=name, tostring(name)\n | join kind=leftouter\n (iotsecurityresources \n | where type=='microsoft.iotsecurity/locations/devicegroups/vulnerabilities' \n | summarize CVECount=count() by name2=tostring(properties.deviceId)) on $left.name == $right.name2 \n | join kind=leftouter\n (iotsecurityresources \n | where type=='microsoft.iotsecurity/locations/devicegroups/alerts' \n | where properties.status != \"Closed\"\n | extend name3= tostring(properties.extendedProperties.SourceDeviceAddress)\n | summarize AlertCount=count() by name3) on $left.DeviceName == $right.name3 \n | join kind=leftouter\n (iotsecurityresources \n | where type=='microsoft.iotsecurity/locations/devicegroups/alerts' \n | where properties.status != \"Closed\"\n | where tostring(properties.extendedProperties.DestinationDeviceAddress)!=tostring(properties.extendedProperties.SourceDeviceAddress)\n | summarize AlertCount2=count() by name4=tostring(properties.extendedProperties.DestinationDeviceAddress)) on $left.DeviceName == $right.name4 \n | project TimLastSeen, tostring(DeviceName), DeviceLink, tostring(DeviceSubType), AlertCountSum=coalesce(AlertCount,0)+coalesce(AlertCount2,0), CVECount, tostring(Site), tostring(Zone), tostring(Sensor),tostring(PurdueLevel), tostring(IPv4), tostring(MACAddress), Protocols, tostring(Vendor), tostring(OperatingSystem), DeviceID=name\n | sort by tostring(TimLastSeen)\n", "size": 0, "showAnalytics": true, "title": "🟦 OT Assets", "noDataMessage": "No Assets Observed, Confirm Logging", "exportFieldName": "DeviceID", "exportParameterName": "pDeviceID", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimLastSeen", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "23ch" }, "dateFormat": { "formatName": "shortDateTimePattern" } }, { "columnMatch": "DeviceName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" } }, { "columnMatch": "DeviceLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Device >>", "customColumnWidthSetting": "15ch" } }, { "columnMatch": "DeviceSubType", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "13ch" } }, { "columnMatch": "CVECount", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "14ch" } }, { "columnMatch": "Site", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" } }, { "columnMatch": "Zone", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "23ch" } }, { "columnMatch": "Sensor", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" } }, { "columnMatch": "PurdueLevel", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" } }, { "columnMatch": "IPv4", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "21ch" } }, { "columnMatch": "Protocols", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "30ch" } }, { "columnMatch": "Vendor", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "30ch" } }, { "columnMatch": "OperatingSystem", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15ch" } }, { "columnMatch": "DeviceID", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "42ch" } }, { "columnMatch": "TimeFirstSeen", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "25ch" }, "dateFormat": { "showUtcTime": null, "formatName": "shortDateTimePattern" } } ], "rowLimit": 10000, "filter": true, "labelSettings": [ { "columnId": "TimLastSeen", "label": "Time Last Seen" }, { "columnId": "DeviceName", "label": "Name" }, { "columnId": "DeviceLink", "label": "Device Link" }, { "columnId": "DeviceSubType", "label": "Type" }, { "columnId": "AlertCountSum", "label": "Open Alerts" }, { "columnId": "CVECount", "label": "CVEs" }, { "columnId": "PurdueLevel", "label": "Purdue Level" }, { "columnId": "MACAddress", "label": "MAC Address" }, { "columnId": "OperatingSystem", "label": "Operating System" }, { "columnId": "DeviceID", "label": "Device ID" } ] } }, "customWidth": "100", "name": "🟦 OT Asset Inventory" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\n iotsecurityresources \n | where type==\"microsoft.iotsecurity/locations/devicegroups/vulnerabilities\"\n | extend name=tostring(properties.deviceId)\n | where '{pDeviceID}' == name\n | project DeviceID=name, CVE=tostring(properties.vulnerabilityId), Severity=tostring(properties.severityScore),CVEDescription=tostring(properties.description)", "size": 4, "showAnalytics": true, "title": "🟦 CVEs - Selected OT Asset", "noDataMessage": "No CVEs Observed.", "exportFieldName": "DeviceID", "exportParameterName": "deviceId", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "DeviceID", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "37ch" } }, { "columnMatch": "CVE", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "16ch" } }, { "columnMatch": "Severity", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "13ch" } }, { "columnMatch": "CVEDescription", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "60ch" } } ], "rowLimit": 100, "filter": true, "labelSettings": [ { "columnId": "DeviceID", "label": "Device ID" }, { "columnId": "CVEDescription", "label": "CVE Description" } ] } }, "customWidth": "50", "name": "🟦 OT Asset Inventory - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/recommendations\"\n| where properties.recommendationType contains 'IoT_OT'\n| extend RecType=iff(properties.recommendationType == \"IoT_OTRecommendation_SecuredStatePLC\", \"Review PLC operating mode\", properties.recommendationType) \n| extend RecType=iff(properties.recommendationType == \"IoT_OTRecommendation_Authorization\", \"Review unauthorized devices\", \"Review PLC operating mode\")\n| extend status = properties.status\n| extend deviceId=properties['recommendationAdditionalData']['DeviceResourceIds']\n| extend name=tostring(split(deviceId,'/')[10])\n| extend name=tostring(split(name,'\"')[0])\n| where '{pDeviceID}' == name\n| where status == \"Unhealthy\"\n| project name, tostring(properties.discoveredTimeUtc), tostring(properties.severity), RecType, tostring(properties.status)", "size": 4, "showAnalytics": true, "title": "🟦 Recommendations - Selected OT Device ", "noDataMessage": "No Recommendations Observed, Confirm Logging", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "properties_discoveredTimeUtc", "formatter": 6, "dateFormat": { "formatName": "shortDateTimePattern" } }, { "columnMatch": "TimeFirstSeen", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "25ch" }, "dateFormat": { "showUtcTime": null, "formatName": "shortDateTimePattern" } }, { "columnMatch": "DeviceName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" } }, { "columnMatch": "DeviceSubType", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "13ch" } }, { "columnMatch": "CVECount", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "14ch" } }, { "columnMatch": "Site", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" } }, { "columnMatch": "Zone", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "23ch" } }, { "columnMatch": "Sensor", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" } }, { "columnMatch": "PurdueLevel", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" } }, { "columnMatch": "IPv4", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "21ch" } }, { "columnMatch": "Protocols", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "30ch" } }, { "columnMatch": "Vendor", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "30ch" } }, { "columnMatch": "OperatingSystem", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15ch" } }, { "columnMatch": "DeviceID", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "42ch" } } ], "rowLimit": 10000, "filter": true, "labelSettings": [ { "columnId": "name", "label": "Device ID" }, { "columnId": "properties_discoveredTimeUtc", "label": "Discovered Time UTC" }, { "columnId": "properties_severity", "label": "Severity" }, { "columnId": "RecType", "label": "Name" }, { "columnId": "properties_status", "label": "Status" } ] }, "tileSettings": { "titleContent": { "columnMatch": "RecType", "formatter": 1 }, "subtitleContent": { "columnMatch": "properties_status" }, "leftContent": { "columnMatch": "properties_severity" }, "showBorder": false } }, "customWidth": "50", "name": "🟦 Recommendations - Selected OT Device " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " iotsecurityresources\n | where type == \"microsoft.iotsecurity/locations/devicegroups/devices\"\n | extend TimeFirstSeen=properties.lastSeen \n | extend PurdueLevel=tostring(properties.purdueLevel)\n | where TimeFirstSeen {TimeRange}\n | extend DeviceName=properties.deviceName\n | extend Zone=tostring(properties.sensor.zone)\n | extend Site=properties.sensor.site\n | extend Sensor=properties.sensor.name\n | where Sensor in ({SensorName})\n | where Site in ({SiteName})\n | where Zone in ({ZoneName})\n | summarize count() by tostring(PurdueLevel)", "size": 3, "title": "Active Devices by Purdue Level", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "piechart", "gridSettings": { "sortBy": [ { "itemKey": "count_", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "count_", "sortOrder": 2 } ], "graphSettings": { "type": 0, "topContent": { "columnMatch": "Column1", "formatter": 1 }, "centerContent": { "columnMatch": "count_", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "33", "name": " Discovered OT devices by date - Copy - Copy - Copy - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " iotsecurityresources\n | where type == \"microsoft.iotsecurity/locations/devicegroups/devices\"\n | extend TimeFirstSeen=properties.lastSeen \n | extend Protocols=trim(@'^\\[\"|\"]$|\"|[|]', tostring(properties.protocols))\n | extend replaced=replace(@'\\(.+?\\)', ' ', tostring(Protocols))\n | where TimeFirstSeen {TimeRange}\n | where Protocols != \"[]\" \n | extend DeviceName=properties.deviceName\n | extend Zone=tostring(properties.sensor.zone)\n | extend Site=properties.sensor.site\n | extend Sensor=properties.sensor.name\n | where Sensor in ({SensorName})\n | where Site in ({SiteName})\n | where Zone in ({ZoneName})\n | extend protocolParse=split(replaced, \",\")\n | mv-expand protocolParse to typeof(string)\n | summarize count() by tostring(protocolParse)", "size": 3, "title": "Active Devices by Protocol", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "piechart", "sortBy": [], "graphSettings": { "type": 0, "topContent": { "columnMatch": "Column1", "formatter": 1 }, "centerContent": { "columnMatch": "count_", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "33", "name": " Discovered OT devices by date - Copy - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " iotsecurityresources\n | where type == \"microsoft.iotsecurity/locations/devicegroups/devices\"\n | extend TimeFirstSeen=properties.lastSeen \n | extend Vendor=tostring(properties.hardware.vendor)\n | where TimeFirstSeen {TimeRange}\n | where Vendor != \"\" \n | extend DeviceName=properties.deviceName\n | extend Zone=tostring(properties.sensor.zone)\n | extend Site=properties.sensor.site\n | extend Sensor=properties.sensor.name\n | where Sensor in ({SensorName})\n | where Site in ({SiteName})\n | where Zone in ({ZoneName})\n | summarize count() by tostring(Vendor)", "size": 3, "title": "Active Devices by Vendor", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "piechart", "gridSettings": { "sortBy": [ { "itemKey": "count_", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "count_", "sortOrder": 2 } ], "graphSettings": { "type": 0, "topContent": { "columnMatch": "Column1", "formatter": 1 }, "centerContent": { "columnMatch": "count_", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "33", "name": " Discovered OT devices by date - Copy - Copy - Copy - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/devices\" \n| extend TimeFirstSeen=properties.lastSeen \n| where TimeFirstSeen {TimeRange}\n| extend Zone=tostring(properties.sensor.zone)\n| extend Site=properties.sensor.site\n| extend Sensor=properties.sensor.name\n| where Sensor in ({SensorName})\n| where Site in ({SiteName})\n| where Zone in ({ZoneName})\n| where tostring(properties.deviceSubTypeDisplayName) != \"Unclassified\"\n| extend SubType=tostring(properties.deviceSubTypeDisplayName)\n| summarize Devices=count() by SubType\n| sort by Devices", "size": 0, "title": "Active Devices by Type ", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "unstackedbar" }, "customWidth": "50", "name": "Discovered OT Devices by Type" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " iotsecurityresources\n | where type == \"microsoft.iotsecurity/locations/devicegroups/devices\"\n | extend TimeFirstSeen=properties.firstSeen \n | where TimeFirstSeen {TimeRange}\n | extend DeviceName=properties.deviceName\n | extend Zone=tostring(properties.sensor.zone)\n | extend Site=properties.sensor.site\n | extend Sensor=properties.sensor.name\n | where Sensor in ({SensorName})\n | where Site in ({SiteName})\n | where Zone in ({ZoneName})\n | where properties.deviceDataSource=='OtSensor'\n | extend myDAY = split(TimeFirstSeen, \"T\", 0) //using split to parse \n | summarize count() by trim( @'^\\[\"|\"]$|\"', tostring(myDAY))", "size": 0, "title": "Discovered Devices by Date", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "unstackedbar" }, "customWidth": "50", "name": " Active devices by date - Copy", "styleSettings": { "margin": "50", "padding": "50", "maxWidth": "50" } } ] }, "conditionalVisibility": { "parameterName": "TAB", "comparison": "isEqualTo", "value": "inventory" }, "name": "Inventory" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Overview" }, "name": "text - 12" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Summary", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/devices\"\n| extend DeviceName=tostring(properties.deviceName)\n| summarize CountDevices=count(DeviceName)\n", "size": 3, "title": "Total Devices", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "tiles", "tileSettings": { "titleContent": {}, "rightContent": { "columnMatch": "CountDevices", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": false, "sortCriteriaField": "CountDevices", "size": "auto" } }, "customWidth": "15", "name": "query - 5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/devices\"\n| extend TimeFirstSeen=properties.lastSeen\n| where TimeFirstSeen {TimeRange}\n| extend DeviceName=tostring(properties.deviceName)\n| summarize CountDevices=count(DeviceName)\n", "size": 3, "title": "Active Devices {TimeRange}", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "tiles", "tileSettings": { "titleContent": {}, "rightContent": { "columnMatch": "CountDevices", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": false, "sortCriteriaField": "CountDevices", "size": "auto" } }, "customWidth": "15", "name": "query - 5 - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| where TimeGenerated {TimeRange}\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\" or Title contains \"(MDIoT)\"\n| where Severity == \"High\" and Status != \"Closed\"\n| summarize AlertCount=count()\n", "size": 3, "title": "High Severity Open Incidents", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "rightContent": { "columnMatch": "AlertCount", "formatter": 12, "formatOptions": { "min": 0, "max": 1, "palette": "redDark" } }, "showBorder": false, "sortCriteriaField": "CountDevices", "size": "auto" } }, "customWidth": "15", "name": "query - 5 - Copy - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/vulnerabilities\"\n| extend severity=properties['severityScore']\n| extend Severity=properties.severityScore\n| where Severity == \"Critical\"\n| summarize count() by tostring(severity)\n", "size": 3, "title": "Critical CVEs", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "min": 0, "max": 1, "palette": "red" } }, "showBorder": false, "sortCriteriaField": "CountDevices", "size": "auto" } }, "customWidth": "10", "name": "query - 5 - Copy - Copy - Copy" } ] }, "name": "Summary" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Inventory Overview", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": " iotsecurityresources\n | where type == \"microsoft.iotsecurity/locations/devicegroups/devices\"\n | extend TimeFirstSeen=properties.lastSeen \n | where TimeFirstSeen {TimeRange}\n | extend DeviceName=properties.deviceName\n | extend Zone=tostring(properties.sensor.zone)\n | extend Site=properties.sensor.site\n | extend Sensor=properties.sensor.name\n | where properties.deviceDataSource=='OtSensor'\n | summarize count() by trim( @'^\\[\"|\"]$|\"', tostring(Site))", "size": 1, "title": "Devices by Site", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "barchart" }, "name": "query - 1", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/devices\" \n| extend TimeFirstSeen=properties.lastSeen \n| where TimeFirstSeen {TimeRange}\n| where tostring(properties.deviceSubTypeDisplayName) != \"Unclassified\"\n| extend SubType=tostring(properties.deviceSubTypeDisplayName)\n| summarize Devices=count() by SubType\n| sort by Devices", "size": 3, "title": "Active Devices by Type", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "piechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "SubType", "formatter": 1 }, "leftContent": { "columnMatch": "Devices", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "Devices", "sizeAggregation": "Sum", "legendMetric": "Devices", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "Devices", "heatmapPalette": "greenRed" } } }, "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " iotsecurityresources\n | where type == \"microsoft.iotsecurity/locations/devicegroups/devices\"\n | extend TimeFirstSeen=properties.lastSeen \n | extend Protocols=trim(@'^\\[\"|\"]$|\"|[|]', tostring(properties.protocols))\n | extend replaced=replace(@'\\(.+?\\)', ' ', tostring(Protocols))\n | where TimeFirstSeen {TimeRange}\n | where Protocols != \"[]\" \n | extend DeviceName=properties.deviceName\n | extend protocolParse=split(replaced, \",\")\n | mv-expand protocolParse to typeof(string)\n | summarize count() by tostring(protocolParse)", "size": 1, "title": "Active OT Devices by Protocol", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "barchart", "gridSettings": { "sortBy": [ { "itemKey": "Column1", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "Column1", "sortOrder": 2 } ], "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Column1", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "Column1", "formatter": 1 }, "centerContent": { "columnMatch": "count_", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "AssetCount", "label": "Discovered Assets" } ] } }, "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " iotsecurityresources\n | where type == \"microsoft.iotsecurity/locations/devicegroups/devices\"\n | extend TimeFirstSeen=properties.firstSeen\n | extend DeviceName=properties.deviceName\n | where TimeFirstSeen {TimeRange}\n | extend DeviceSubType=iff(properties.deviceSubTypeDisplayName==\"Unclassified\", \"\", properties.deviceSubTypeDisplayName)\n | extend Site=properties.sensor.site\n | where properties.deviceDataSource=='OtSensor'\n | extend data=split(id, '/')\n | extend StringforBase64function = strcat('{\"subscriptionId\":\"', data[2], '\",\"deviceId\":\"', data[10], '\",\"location\":\"', data[6], '\",\"deviceGroupName\":\"', data[8], '\"}')\n | extend devicelink = base64_encode_tostring(StringforBase64function)\n | project TimeFirstSeen, tostring(DeviceName), DeviceLink=strcat(\"https://portal.azure.com/#view/Microsoft_Azure_IoT_Defender/IDeviceBlade/data/\",devicelink), tostring(DeviceSubType), tostring(Site)\n | join kind=leftouter\n (iotsecurityresources \n | where type=='microsoft.iotsecurity/locations/devicegroups/alerts' \n | where properties.status != \"Closed\"\n | extend name3= tostring(properties.extendedProperties.SourceDeviceAddress)\n | summarize AlertCount=count() by name3) on $left.DeviceName == $right.name3 \n | join kind=leftouter\n (iotsecurityresources \n | where type=='microsoft.iotsecurity/locations/devicegroups/alerts' \n | where properties.status != \"Closed\"\n | where tostring(properties.extendedProperties.DestinationDeviceAddress)!=tostring(properties.extendedProperties.SourceDeviceAddress)\n | summarize AlertCount2=count() by name4=tostring(properties.extendedProperties.DestinationDeviceAddress)) on $left.DeviceName == $right.name4 \n | project TimeFirstSeen, tostring(DeviceName), DeviceLink, tostring(DeviceSubType), AlertCountSum=coalesce(AlertCount,0)+coalesce(AlertCount2,0), tostring(Site)\n | sort by tostring(TimeFirstSeen)\n | take 50", "size": 0, "title": "Recent Discovered Devices", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeFirstSeen", "formatter": 6, "formatOptions": { "customColumnWidthSetting": "24ch" }, "dateFormat": { "formatName": "shortDateTimePattern" } }, { "columnMatch": "DeviceName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" } }, { "columnMatch": "DeviceLink", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Device >>", "customColumnWidthSetting": "16ch" } }, { "columnMatch": "DeviceSubType", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15ch" } }, { "columnMatch": "AlertCountSum", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "16ch" } }, { "columnMatch": "Site", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "30ch" } } ], "rowLimit": 50, "labelSettings": [ { "columnId": "TimeFirstSeen", "label": "Time First Seen" }, { "columnId": "DeviceName", "label": "Device Name" }, { "columnId": "DeviceLink", "label": "Device Link" }, { "columnId": "DeviceSubType", "label": "Type" }, { "columnId": "AlertCountSum", "label": "Open Alerts" } ] } }, "name": "query - 1 - Copy", "styleSettings": { "showBorder": true } } ] }, "customWidth": "33", "name": "group - 2", "styleSettings": { "margin": "0", "padding": "30px", "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Threat Detection Overview", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| where TimeGenerated {TimeRange}\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\" or Title contains \"(MDIoT)\"\n| extend SystemAlertId = tostring(AlertIds[0])\n| join (SecurityAlert) on SystemAlertId\n| mv-expand deviceEntities=parse_json(Entities)\n| extend deviceSite = tostring(deviceEntities.Site)\n| where isnotempty(deviceSite) \n| summarize AlertCount=dcount(ProviderIncidentId) by deviceSite \n| sort by AlertCount desc", "size": 1, "title": "Incidents by Site", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "barchart" }, "name": "query - 3", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| where TimeGenerated {TimeRange}\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\" or Title contains \"(MDIoT)\"\n| summarize AlertCount=count() by tostring(Severity)\n", "size": 3, "title": "Incidents by Severity", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart", "chartSettings": { "xAxis": "TimeGenerated", "yAxis": [ "AlertCount" ], "seriesLabelSettings": [ { "seriesName": "", "label": "Alert Count" }, { "seriesName": "Low", "color": "yellow" }, { "seriesName": "Medium", "color": "orange" }, { "seriesName": "High", "color": "redBright" } ] } }, "name": "query - 1 - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| where TimeGenerated {TimeRange}\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\" or Title contains \"(MDIoT)\"\n| summarize AlertCount=count() by bin(TimeGenerated, 1d),tostring(Severity)\n", "size": 1, "title": "Incidents Trend Overtime", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "timechart", "chartSettings": { "xAxis": "TimeGenerated", "yAxis": [ "AlertCount" ], "group": "Severity", "createOtherGroup": 0, "showLegend": true, "seriesLabelSettings": [ { "seriesName": "", "label": "Alert Count" }, { "seriesName": "Low", "color": "yellow" }, { "seriesName": "Medium", "color": "orange" }, { "seriesName": "High", "color": "redBright" } ], "xSettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } } } } }, "name": "query - 1", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityIncident\n| extend ProductName = tostring(parse_json(tostring(AdditionalData.alertProductNames))[0])\n| where ProductName contains \"iot\"\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| parse IncidentUrl with * '/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\n| sort by SeverityRank, TimeGenerated desc\n| project TimeGenerated,['Incident Name']=Title, URL=IncidentUrl, IncidentNumber, Severity, Status\n| limit 50", "size": 0, "title": "Recent Open Incidents", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "22ch" } }, { "columnMatch": "Incident Name", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "24ch" } }, { "columnMatch": "IncidentNumber", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15ch" } }, { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Medium", "representation": "Sev1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "Sev2", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "Sev0", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": null, "text": "{0}{1}" } ] } }, { "columnMatch": "Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "New", "representation": "AddTile", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "InProgress", "representation": "pending", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Closed", "representation": "success", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "URL", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Incident >>", "bladeOpenContext": { "bladeParameters": [] } } }, { "columnMatch": "IncidentUrl", "formatter": 7, "formatOptions": { "linkTarget": "OpenBlade", "linkLabel": "Incident >>", "bladeOpenContext": { "bladeName": "CaseBlade", "extensionName": "Microsoft_Azure_Security_Insights", "bladeParameters": [] } } } ], "rowLimit": 50, "labelSettings": [ { "columnId": "Incident Name", "label": "Incident Name" }, { "columnId": "URL", "label": "Link" }, { "columnId": "IncidentNumber", "label": "Incident ID" } ] } }, "name": "query - 0 - Copy", "styleSettings": { "showBorder": true } } ] }, "customWidth": "33", "name": "group - 1", "styleSettings": { "padding": "30px", "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Vulnerabilities Overview", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": " iotsecurityresources\n | where type == \"microsoft.iotsecurity/locations/devicegroups/vulnerabilities\"\n | extend severity=properties['severityScore'],\n deviceId=tostring(properties['deviceId']),\n score=properties['score'],\n cveName = properties['vulnerabilityId'],\n cveDes=properties['description']\n | project deviceId\n | join  kind=leftouter (iotsecurityresources\n          | where type=='microsoft.iotsecurity/locations/devicegroups/devices'\n          | project Site=tostring(properties.sensor.site), name) on $left.deviceId == $right.name\n | summarize count() by Site\n | project site = iff(Site==\"\", \"Managed IoT Hub\", Site), count_\n", "size": 1, "title": "CVEs by Site", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "barchart", "graphSettings": { "type": 0, "topContent": { "columnMatch": "site", "formatter": 1 }, "centerContent": { "columnMatch": "sum_count_", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "group": "Severity", "createOtherGroup": 0 } }, "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/vulnerabilities\"\n| extend severity=properties['severityScore']\n| extend Severity=properties.severityScore\n| summarize count() by tostring(severity )\n", "size": 3, "title": "CVEs by Severity", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "piechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "High", "color": "redBright" }, { "seriesName": "Medium", "color": "orange" }, { "seriesName": "Critical", "color": "redDark" }, { "seriesName": "Low", "color": "yellow" } ] } }, "name": "query - 1", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/vulnerabilities\"\n| extend DeviceID = tostring(properties.deviceId)\n| extend severity=properties['severityScore'],\n deviceId=tostring(properties['deviceId']),\n score=properties['score'],\n cveName = properties['vulnerabilityId'],\n cveDes=properties['description']\n| mv-expand components=properties['affectedComponents'] \n| extend vendor=components['vendor'],\n version=components['version'],\n type=components['type'],\n product=components['product']\n| extend Severity=properties.severityScore\n| join kind=leftouter (iotsecurityresources\n | where type=='microsoft.iotsecurity/locations/devicegroups/devices'\n | project DeviceSiteName=tostring(properties.sensor.site), name) on $left.DeviceID == $right.name\n| summarize count() by tostring(cveName), tostring(vendor) \n| summarize count() by tostring(vendor) \n| where vendor != '*'", "size": 1, "title": "CVEs by Vendor", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "barchart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "High", "color": "redBright" }, { "seriesName": "Medium", "color": "orange" }, { "seriesName": "Critical", "color": "redDark" }, { "seriesName": "Low", "color": "yellow" } ] } }, "name": "query - 1 - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "iotsecurityresources\n| where type == \"microsoft.iotsecurity/locations/devicegroups/vulnerabilities\"\n| extend DeviceID = tostring(properties.deviceId)\n| extend severity=properties['severityScore'],\n deviceId=tostring(properties['deviceId']),\n score=properties['score'],\n cveName = properties['vulnerabilityId'],\n cveDes=properties['description']\n| extend Severity=properties.severityScore\n| join kind=leftouter (iotsecurityresources\n | where type=='microsoft.iotsecurity/locations/devicegroups/devices'\n | extend DeviceName = tostring(properties.deviceName)\n | project DeviceSiteName=tostring(properties.sensor.site), name, DeviceName) on $left.DeviceID == $right.name\n | join kind=leftouter\n (iotsecurityresources \n | where type=='microsoft.iotsecurity/locations/devicegroups/alerts' \n | where properties.status != \"Closed\"\n | extend name3= tostring(properties.extendedProperties.SourceDeviceAddress)\n | summarize AlertCount=count() by name3) on $left.DeviceName == $right.name3 \n| join kind=leftouter\n (iotsecurityresources \n | where type=='microsoft.iotsecurity/locations/devicegroups/alerts' \n | where properties.status != \"Closed\"\n | where tostring(properties.extendedProperties.DestinationDeviceAddress)!=tostring(properties.extendedProperties.SourceDeviceAddress)\n | summarize AlertCount2=count() by name4=tostring(properties.extendedProperties.DestinationDeviceAddress)) on $left.DeviceName == $right.name4 \n| summarize Total = count(), Critical = countif(tostring(severity) == \"Critical\"), High = countif(tostring(severity) == \"High\"), Medium = countif(tostring(severity) == \"Medium\"), Low = countif(tostring(severity) == \"Low\") by deviceId, DeviceName, AlertCountSum=coalesce(AlertCount,0)+coalesce(AlertCount2,0)\n| project DeviceName, AlertCountSum, Total, Critical, High, Medium, Low, deviceId\n| sort by Total\n| take 50\n", "size": 0, "title": "Top Vulnerable Devices", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Subscription}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "deviceId", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "38ch" } }, { "columnMatch": "DeviceName", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "17ch" } }, { "columnMatch": "AlertCountSum", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "16ch" } }, { "columnMatch": "Total", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "14ch" } }, { "columnMatch": "Critical", "formatter": 8, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "11ch" } }, { "columnMatch": "High", "formatter": 8, "formatOptions": { "palette": "redBright" } }, { "columnMatch": "Medium", "formatter": 8, "formatOptions": { "palette": "orange" } }, { "columnMatch": "Low", "formatter": 8, "formatOptions": { "palette": "yellow" } } ], "rowLimit": 50, "sortBy": [ { "itemKey": "Total", "sortOrder": 2 } ], "labelSettings": [ { "columnId": "DeviceName", "label": "Device Name" }, { "columnId": "AlertCountSum", "label": "Open Alerts" }, { "columnId": "Total", "label": "Total CVEs" }, { "columnId": "deviceId", "label": "Device ID" } ] }, "sortBy": [ { "itemKey": "Total", "sortOrder": 2 } ] }, "name": "query - 0", "styleSettings": { "showBorder": true } } ] }, "customWidth": "33", "name": "group - 3", "styleSettings": { "padding": "30px", "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "TAB", "comparison": "isEqualTo", "value": "overview" }, "customWidth": "0", "name": "group - 11", "styleSettings": { "margin": "30", "padding": "30", "showBorder": true } } ], "fromTemplateId": "sentinel-IoTOTThreatMonitoringwithDefenderforIoT", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }