{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "## Sensitive Operations in Azure Activity Logs\n---\n\n" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "c8d0a421-e106-400d-a9a6-753333b2927e", "version": "KqlParameterItem/1.0", "name": "Subscription", "type": 6, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "value": [ "/subscriptions/d0d4dfbc-9f34-41b1-8767-58818e4ac738" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "includeAll": false, "showDefault": false }, "timeContext": { "durationMs": 86400000 } }, { "id": "15ae10ce-a737-4d1e-bb84-0490207e8c7d", "version": "KqlParameterItem/1.0", "name": "Workspace", "type": 5, "description": "Select Workspace where Azure Activity Logs are available", "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| project id", "crossComponentResources": [ "{Subscription}" ], "value": [ "/subscriptions/d0d4dfbc-9f34-41b1-8767-58818e4ac738/resourceGroups/contoso-mgmt/providers/Microsoft.OperationalInsights/workspaces/contoso-la" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "2deb21f7-8d02-4112-aee2-df86abceec6f", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "value": { "durationMs": 8816400000, "endTime": "2022-11-11T18:31:00.000Z" }, "typeSettings": { "selectableValues": [ { "durationMs": 86400000 }, { "durationMs": 604800000 }, { "durationMs": 2592000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 9" }, { "type": 1, "content": { "json": "This Workbook utilizes Azure Activity Logs as a data source and it can be used to monitor sensitive operations from security aspects. Suspecious activities in Azure Resources can be detected by reviewing who performed it and from which IP.This workbook leverages detection methods provided in Azure Threat Research Matrix for Azure Activity Logs.", "style": "info" }, "name": "text - 28" }, { "type": 1, "content": { "json": "  Please take time to answer a quick survey,\r\n[ click here. ](https://forms.microsoft.com/Pages/ResponsePage.aspx?id=v4j5cvGGr0GRqy180BHbR6WFGSmpLgBFs8JcO3-8uANUOUpaWlNYWEIxTTI0VldWVk40V0VBOFVIWS4u)" }, "name": "text - 27" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "tabStyle": "bigger", "links": [ { "id": "c739b2d9-5aae-49d6-a60d-71e2579027a3", "cellValue": "wbtab", "linkTarget": "parameter", "linkLabel": "Overall Activities", "subTarget": "overall", "preText": "Overall Activities", "style": "link" }, { "id": "8d0877b6-40e9-49cd-aca6-19de8a51ba91", "cellValue": "wbtab", "linkTarget": "parameter", "linkLabel": "Compute", "subTarget": "compute", "style": "link" }, { "id": "e5eff5f5-d41e-4a4d-9756-9701368ab954", "cellValue": "wbtab", "linkTarget": "parameter", "linkLabel": "Network", "subTarget": "network", "style": "link" }, { "id": "e6003cc2-c70f-4d76-9e44-4f51f549234b", "cellValue": "wbtab", "linkTarget": "parameter", "linkLabel": "Policy", "subTarget": "policy", "style": "link" }, { "id": "d3d8e694-6d6a-42d8-a771-14c36c1b4721", "cellValue": "wbtab", "linkTarget": "parameter", "linkLabel": "Security", "subTarget": "security", "style": "link" }, { "id": "9e5ce69d-94ef-4dc8-9d70-9e01d410481a", "cellValue": "wbtab", "linkTarget": "parameter", "linkLabel": "Data", "subTarget": "data", "style": "link" }, { "id": "e1827ecf-625c-4d02-a78d-17f47f0853b2", "cellValue": "wbtab", "linkTarget": "parameter", "linkLabel": "Account", "subTarget": "account", "style": "link" }, { "id": "0b23a7ca-8b0a-4c01-b521-b67e7471fabd", "cellValue": "wbtab", "linkTarget": "parameter", "linkLabel": "Application", "subTarget": "app", "style": "link" }, { "id": "c4024de2-141c-4b01-b223-2cd1ae86c09a", "cellValue": "wbtab", "linkTarget": "parameter", "linkLabel": "External Access", "subTarget": "external", "style": "link" } ] }, "name": "links - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n//| where Category == \"Administrative\"\r\n//| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| summarize deletions = countif(OperationNameValue hassuffix \"Delete\"), updates = countif(OperationNameValue hassuffix \"write\"), Activities = count() by Caller", "size": 0, "showAnalytics": true, "title": "Overall Activities", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "Caller", "exportParameterName": "callerexport", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "overall" }, "name": "Overall Activities" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where Caller == \"{callerexport}\"\r\n//| where Category == \"Administrative\"\r\n//| where OperationNameValue hassuffix \"Delete\" or OperationNameValue hassuffix \"write\"\r\n//| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 0, "title": "Selected Caller Activities", "noDataMessage": "Please select caller from above overall activities table", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "overall" }, "name": "Caller Activities" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where Caller == \"{callerexport}\"\r\n//| where Category == \"Administrative\"\r\n//| where OperationNameValue hassuffix \"Delete\" or OperationNameValue hassuffix \"write\"\r\n//| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| summarize total=count(), min(TimeGenerated), max(TimeGenerated) by OperationNameValue, Caller\r\n| sort by total desc ", "size": 0, "title": "Operations with earliest and latest occurance for the selected caller", "noDataMessage": "Please select caller from above overall activities table", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "overall" }, "name": "Caller Activities - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.SecurityInsights/alertRules/write\", \"Microsoft.SecurityInsights/alertRules/delete\"]);\r\n// Microsoft Sentinel Analytics - Rule Create / Update / Delete\r\nAzureActivity\r\n//| where Category == \"Administrative\"\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Sentinel Analytic Rules Changes", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "security" }, "name": "Sentinel Analytic Rules Changes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.Network/networkSecurityGroups/write\", \"Microsoft.Network/networkSecurityGroups/delete\"]);\r\n// Azure NSG Create / Update / Delete\r\nAzureActivity\r\n//| where Category == \"Administrative\"\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "NSG Rule Changes", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "network" }, "name": "NSG Rule Changes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.SecurityInsights/dataConnectors/write\", \"Microsoft.SecurityInsights/dataConnectors/delete\"]);\r\n// Microsoft Sentinel Data Connectors Update / Delete\r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "title": "Sentinel Data Connector Changes", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "security" }, "name": "Sentinel Data Connector Changes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.Insights/ActivityLogAlerts/Delete\", \"Microsoft.Insights/ActivityLogAlerts/Write\", \"Microsoft.Insights/ActionGroups/Write\", \"Microsoft.Insights/ActionGroups/Delete\"]);\r\n// Log Alerts Update / Delete\r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Azure Log Alerts Changes", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "security" }, "name": "Azure Log Alerts Changes " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"microsoft.insights/diagnosticSettings/delete\", \"microsoft.insights/diagnosticSettings/write\"]);\r\n// Diagnostic Settings Update / Delete\r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Resource Diagnostic Settings Changes ", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "security" }, "name": "Resource Diagnostic Settings Changes " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.Authorization/policyAssignments/delete\", \"Microsoft.Authorization/policyAssignments/write\", \"Microsoft.Authorization/policyDefinitions/delete\"]);\r\n// Azure Policy Update / Delete\r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Azure Policy Changes ", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "policy" }, "name": "Azure Policy Changes " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.Authorization/locks/write\", \"Microsoft.Authorization/locks/delete\"]);\r\n// Azure Policy Update / Delete\r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Azure Resource Locks Changes ", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "policy" }, "name": "Azure Resource Locks Changes " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where OperationNameValue == \"Microsoft.Authorization/policies/deny/action\"\r\n| where ActivityStatusValue == \"Failed\"\r\n| extend Policydetail = tolower(tostring(todynamic(Properties).['policies']))\r\n| extend PolicyAssignmentName = tolower(tostring(todynamic(Policydetail)[0].['policyassignmentdisplayname']))\r\n| extend PolicyDefinitionName = tolower(tostring(todynamic(Policydetail)[0].['policydefinitiondisplayname']))\r\n| extend AssignementID = tolower(tostring(todynamic(Policydetail)[0].['policyassignmentid']))\r\n| project TimeGenerated, Caller, ActivityStatusValue, ResourceGroup, ResourceProviderValue, Resource, _ResourceId, _SubscriptionId, PolicyAssignmentName, PolicyDefinitionName, AssignementID", "size": 1, "showAnalytics": true, "title": "Resource Deployment Denied by Azure Policy", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "policy" }, "name": "Resource Deployment Denied by Azure Policy " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where OperationNameValue == \"Microsoft.Authorization/policies/deployIfNotExists/action\"\r\n| extend Pupdated = tolower(tostring(todynamic(Properties).['updatedResources']))\r\n| where Pupdated != \"[]\" and Pupdated != \"\"\r\n| extend Policydetail = tolower(tostring(todynamic(Properties).['policies']))\r\n| extend PolicyName = tolower(tostring(todynamic(Policydetail)[0].['policyassignmentdisplayname']))\r\n| extend PolicyDefinitionName = tolower(tostring(todynamic(Policydetail)[0].['policydefinitiondisplayname']))\r\n| extend AssignementID = tolower(tostring(todynamic(Policydetail)[0].['policyassignmentid']))\r\n| project Resource, ResourceGroup, _ResourceId, SubscriptionId, Caller, PolicyName, PolicyDefinitionName, AssignementID, UpdatedObject=Pupdated \r\n", "size": 1, "showAnalytics": true, "title": "Resource Deployment Performed by Azure Policy", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "policy" }, "name": "Resource Deployment performed by Azure Policy " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.Sql/servers/administrators/write\", \"Microsoft.Sql/servers/administrators/delete\",\"Microsoft.Sql/servers/elasticPools/delete\",\"Microsoft.Sql/servers/databases/delete\"]);\r\n// Azure SQL Update / Delete\r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in~ (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Azure SQL Changes ", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "data" }, "name": "Azure SQL Changes " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.Storage/storageAccounts/delete\", \"Microsoft.Storage/storageAccounts/create\", \"Microsoft.Storage/storageAccounts/objectReplicationPolicies/write\", \"Microsoft.Storage/storageAccounts/listkeys/action\", \"Microsoft.Storage/storageAccounts/listAccountSas/action\"]);\r\n// Azure Storage Delete\r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in~ (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Azure Storage Account Changes ", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "data" }, "name": "Azure Storage Changes " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.KeyVault/vaults/write\", \"Microsoft.KeyVault/vaults/delete\",\"Microsoft.KeyVault/vaults/secrets/write\"]);\r\n// Keyvault \r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in~ (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Azure KeyVault Changes ", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "data" }, "name": "Azure KeyVault Changes " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//let opValues = dynamic([\"Microsoft.Network/dnszones/write\", \"Microsoft.Network/dnszones/delete\"]);\r\n// Azure Storage Delete\r\nAzureActivity\r\n| where OperationNameValue contains \"dnszones\"\r\n| where ActivityStatus == \"Succeeded\"\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Azure DNS Changes ", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "network" }, "name": "Azure DNS Changes " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"microsoft.insights/workbooks/write\", \"microsoft.insights/workbooks/delete\"]);\r\n// Microsoft Sentinel Workbook Create / Update / Delete\r\nAzureActivity\r\n//| where Category == \"Administrative\"\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in~ (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Sentinel Workbook Changes", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "security" }, "name": "Sentinel Workbook Changes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// VM extensions Create / Update \r\nAzureActivity\r\n//| where Category == \"Administrative\"\r\n| where OperationName =~ \"Create or Update Virtual Machine Extension\"\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "VM Extension Changes", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "compute" }, "name": "VM Extension Changes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.Compute/galleries/write\", \"Microsoft.Compute/galleries/applications/write\", \"Microsoft.Compute/galleries/applications/versions/write\"]);\r\n// Gallery Application\r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n//| where ActivitySubstatusValue in~ (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Compute Gallery Application Changes ", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "compute" }, "name": "Compute Gallery Application Changes " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"microsoft.compute/virtualmachines/runcommand/action\", \"Microsoft.Compute/virtualMachineScaleSets/virtualMachines/runCommand/action\"]);\r\n// VM and VMSS Run Command\r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n//| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "VM Run Commands", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "compute" }, "name": "VM Run Commands" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| extend OperationNameValue\r\n| where OperationNameValue =~ \"MICROSOFT.RESOURCES/DEPLOYMENTS/VALIDATE/ACTION\"\r\n| where _ResourceId contains \"VMAccessWindowsPasswordReset\"\r\n//| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatusValue, Caller, CallerIpAddress, _ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "VM Password Reset", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "compute" }, "name": "VM Password Reset" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| extend OperationNameValue\r\n| where OperationNameValue =~ \"Microsoft.Compute/disks/BeginGetAccess/action\"\r\n//| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatusValue, Caller, CallerIpAddress, _ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "VM Disk SAS URI", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "compute" }, "name": "VM Disk SAS URI" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.ContainerService/managedClusters/runcommand/action\", \"Microsoft.ContainerService/managedclusters/commandResults/read\"]);\r\n// AKS\r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n//| where ActivitySubstatusValue in~ (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "AKS Cluster Command Invoke", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "compute" }, "name": "AKS Cluster Command Invoke" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"microsoft.web/sites/delete\", \"microsoft.web/sites/config\", \"Microsoft.Web/sites/write\", \"Microsoft.Web/sites/start/action\",\"Microsoft.Web/sites/hostruntime/host/action\", \"Microsoft.Web/sites/hostruntime/vfs/run.csx/write\" ]);\r\n// App Services Changes\r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in~ (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "App Services Changes", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "app" }, "name": "App Services Changes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.Logic/workflows/write\", \"Microsoft.Logic/workflows/run/action\", \"Microsoft.Logic/operations/read\", \"Microsoft.Logic/locations/workflows/recommendOperationGroups/action\", \"Microsoft.Logic/workflows/triggers/listCallbackUrl/action\",\"Microsoft.Web/connections/write\" ]);\r\n// Logic App \r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in~ (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Logic Application HTTP Trigger Changes", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "app" }, "name": "Logic Application HTTP Trigger Changes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.web/sites/functions/action\",\"Microsoft.web/sites/functions/write\" ]);\r\n// Function App \r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in~ (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Function App HTTP Trigger Changes", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "app" }, "name": "Function App HTTP Trigger Changes - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.Automation/automationAccounts/runbooks/*\",\"Microsoft.Automation/automationAccounts/webhooks/write\" ]);\r\n// Runbook App \r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in~ (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Automation Account Runbook Webhook Changes ", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "app" }, "name": "Automation Account Runbook Webhook Changes " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"microsoft.authorizations/elevateaccess/action\", \"microsoft.authorization/roleassignments/write\"]);\r\n// Role Changes\r\nAzureActivity\r\n//| where Category == \"Administrative\"\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in~ (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Azure Resources Role Changes", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "account" }, "name": "Azure Resources Role Changes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where OperationNameValue =~ \"Microsoft.ManagedServices/registrationAssignments/Write\"\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Lighthouse Registration Assignments by Service Provider", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "external" }, "name": "Lighthouse Registration Assignments by Service Provider" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ManagedServicesResources\r\n| where type== \"microsoft.managedservices/registrationassignments\"", "size": 1, "showAnalytics": true, "title": "List of Lighthouse Registration Assignments by Service Provider", "showRefreshButton": true, "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "external" }, "name": "List of Lighthouse Registration Assignments by Service Provider - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Provide your Tenant Domain (example contoso.com)\r\nlet Hometenantdomain = dynamic([\"TENANT_DOMAIN_VALUE\"]);\r\nAzureActivity\r\n| where Caller !contains Hometenantdomain\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| where parse_json(Claims).idtyp <> \"app\"\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, \r\n ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Activities performed by Guest Users(Provide your Home Tenant Domain in the Query) ", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "external" }, "name": "Activities performed by Guest Users " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let HomeTenantId = \"Provide your Azure AD Tenant ID HERE\";\r\n//example HomeTenantId= \"8756erxyz\"\r\nAzureActivity\r\n| extend TenantId = todynamic(Claims).['http://schemas.microsoft.com/identity/claims/tenantid']\r\n| where TenantId != HomeTenantId\r\n| where isnotempty( TenantId )\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, TenantId , Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Activities performed by external Lighthouse (CSP/MSP) Users (Provide your Home Tenant ID in the Query) ", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "external" }, "name": "Activities performed by external CSP/MSP Users " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where OperationNameValue has_any (\"ipfilterrules\", \"securityRules\", \"publicIPAddresses\", \"firewallrules\") and OperationNameValue endswith \"write\"\r\n// Choosing Accepted here because it has the Rule Attributes included\r\n| where ActivityStatusValue == \"Accepted\" \r\n// If there is publicIP info, include it\r\n| extend publicIPAddress_ = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).ipAddress) \r\n| extend publicIPAddressVersion_ = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).publicIPAddressVersion) \r\n| extend publicIPAllocationMethod_ = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).publicIPAllocationMethod) \r\n// Include rule attributes for context\r\n| extend access = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).access) \r\n| extend description = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).description) \r\n| extend destinationPortRange = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).destinationPortRange) \r\n| extend direction = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).direction) \r\n| extend protocol = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).protocol) \r\n| extend sourcePortRange = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).sourcePortRange) \r\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), ResourceIds = makeset(ResourceId) by Caller, CallerIpAddress, Resource, ResourceGroup, \r\nActivityStatusValue, ActivitySubstatus, SubscriptionId, access, description, destinationPortRange, direction, protocol, sourcePortRange \r\n| extend timestamp = StartTime, AccountCustomEntity = Caller, IPCustomEntity = CallerIpAddress\r\n\r\n", "size": 1, "showAnalytics": true, "title": "Network port changes ", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "network" }, "name": "Network port changes " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let OperationNames = dynamic([\"microsoft.compute/virtualMachines/write\", \"microsoft.resources/deployments/write\"]);\r\nAzureActivity\r\n// We look for any Operation that modified and then was accepted or succeeded where a publicipaddress component is referenced\r\n| where OperationNameValue in~ (OperationNames)\r\n| where ActivityStatusValue has_any (\"Succeeded\", \"Accepted\")\r\n| where Properties contains \"publicipaddress\"\r\n//| extend frontendIPConfigurations = Properties.responseBody.properties.frontendIPConfigurations\r\n// parsing the publicIPAddress from Properties. It is only available if the allocation method is Static.\r\n| parse Properties with * \"publicIPAddress\\\\\" PublicIPAddressParse\r\n| extend publicIPAddress_ = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).ipAddress) \r\n| extend publicIPAddressVersion_ = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).publicIPAddressVersion) \r\n| extend publicIPAllocationMethod_ = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).publicIPAllocationMethod) \r\n| extend scope_ = tostring(parse_json(Authorization).scope) \r\n| project\r\n TimeGenerated,\r\n OperationNameValue,\r\n publicIPAllocationMethod_,\r\n publicIPAddressVersion_,\r\n scope_,\r\n Caller,\r\n CallerIpAddress,\r\n ActivityStatusValue,\r\n Resource \r\n", "size": 1, "showAnalytics": true, "title": "VM Public IP Assignment Changes", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "compute" }, "name": "VM Public IP Assignment Changes" } ], "fallbackResourceIds": [ "/subscriptions/5bb40680-7050-4d99-81ab-6b85138025b6/resourcegroups/az1010101-rg/providers/microsoft.operationalinsights/workspaces/azureactivityloglaw" ], "fromTemplateId": "sentinel-AzureSensitiveOperationsReview", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }