{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "b608e714-b3ec-4380-b666-1aa781513ab4", "version": "KqlParameterItem/1.0", "name": "Subscription", "type": 6, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "includeAll": false }, "label": "☁️ Subscription", "value": [ "/subscriptions/cc519aa2-4ddf-4e59-a0c2-a785d967e829" ] }, { "id": "f408f1cf-dbcb-4f57-9409-272374bd3cd4", "version": "KqlParameterItem/1.0", "name": "Workspace", "type": 5, "isRequired": true, "query": "Resources | where type =~ \"microsoft.operationalinsights/workspaces\" | order by name | project id, name, selected=row_number()==1, group=resourceGroup", "crossComponentResources": [ "{Subscription}" ], "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "label": "🗂️ Workspace", "value": "/subscriptions/cc519aa2-4ddf-4e59-a0c2-a785d967e829/resourceGroups/JamfProtect/providers/Microsoft.OperationalInsights/workspaces/3-2-4-27" }, { "id": "397d983f-ea80-4aa5-8c65-547d40cb312b", "version": "KqlParameterItem/1.0", "name": "_timetoken", "label": "⏱️ Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "value": { "durationMs": 172800000 } }, { "id": "d716fb1e-0d71-4e99-9406-18ae7df6e037", "version": "KqlParameterItem/1.0", "name": "changelog", "label": "📖 Changelog", "type": 10, "isRequired": true, "typeSettings": { "showDefault": false }, "jsonData": "[\r\n { \"value\": \"Yes\", \"label\": \"Yes\"},\r\n {\"value\": \"No\", \"label\": \"No\", \"selected\":true }\r\n]" } ], "style": "above", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "Parameters Picker" }, { "type": 1, "content": { "json": "## Jamf Protect for Microsoft Sentinel!\n\nThe [Jamf Protect](https://www.jamf.com/solutions/threat-prevention-remediation/) for Microsoft Sentinel solution creates detailed event data from macOS endpoints into a Microsoft Sentinel workspace in a simple and easy workflow. The solution provides you with full visibility into Apple Endpoint Security by leveraging Workbooks containing [Alert](https://docs.jamf.com/jamf-protect/documentation/Alerts.html) and [Unified Logging](https://docs.jamf.com/jamf-protect/documentation/Unified_Logging.html) events captured by Jamf Protect and the [macOS built-in security events](https://support.apple.com/en-gb/guide/security/sec469d47bd8/web) that occurred across the protected organisational endpoints\n\n\n#### Changelog\n\n**v2.2.0**\n\n***Workbook***\n - Added System Performance Metrics\n - Includes Energy Impact\n - Added Network Traffic Stream\n - Updated Workbook to make use of the newly added parser\n - Added and tweaked querys and graphs\n\n ***Parser***\n - Added JamfProtect parser for parsing and mapping all incoming raw data.\n\n ***Analytic Rules***\n - Updated Analytic Rules to make use of the newly added parser. \n\t\n**v2.1**\n\n***Workbook***\n - Added Endpoint Telemetry\n - Includes graphs and visualisations\n\t- Includes Endpoint Information\n\t- Includes Jamf Pro log parser\n- Added Network Threat Events\n \t- Includes graphs and visualisations\n- Added new Pickers\n - Allows selecting different Log Analytic Workspaces\n - Changed TimeRanger picker\n- Added Changelog\n\n**Analytic Rules**\n\n- Added Analytic Rules\n\t- Jamf Protect - Alerts\n\t- Jamf Protect - Unified Logs\n\t- Jamf Protect - Network Threat Events\n\n\n **v2.0**\n \n- Initial release of the solution containing a basic Workbook\n" }, "conditionalVisibility": { "parameterName": "changelog", "comparison": "isEqualTo", "value": "Yes" }, "name": "Text - Changelog" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Threat Hunting {_timetoken:value}", "expandable": true, "expanded": true, "items": [ { "type": 1, "content": { "json": "Set an type and provide values to search on File hash, CVE numbers or report on Alerts mapped to the MITRE framework or display latest alerts for a single endpoint.", "style": "info" }, "name": "Text - Threat Hunting", "styleSettings": { "showBorder": true } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "5f5886d0-e83e-4ffc-a48c-bfed7370aa66", "version": "KqlParameterItem/1.0", "name": "_type", "label": "Type", "type": 2, "description": "Please choose the type", "isGlobal": true, "typeSettings": { "showDefault": false }, "jsonData": "[\n { \"value\":\"filehash\", \"label\":\"File Hash\" },\n { \"value\":\"CVE\", \"label\":\"CVE\" },\n { \"value\":\"mitre\", \"label\":\"Framework: MITRE\" },\n { \"value\":\"endpointalerts\", \"label\":\"Latest alerts for a single endpoint\" }\n]", "value": "endpointalerts" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "15", "name": "Picker - Threat Hunting Type" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ "{Workspace}" ], "parameters": [ { "id": "49255f47-8f93-4746-8260-aad07befdb06", "version": "KqlParameterItem/1.0", "name": "_hostnamealert", "label": "Hostname", "type": 2, "query": "jamfprotectalerts_CL\n| where isnotempty(DvcHostname)\n | project-keep DvcHostname\n| project-rename Hostname = DvcHostname\n| summarize by tostring(Hostname)", "crossComponentResources": [ "{Workspace}" ], "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "_timetoken", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "admin’s Virtual Machine" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "conditionalVisibilities": [ { "parameterName": "_type", "comparison": "isNotEqualTo", "value": "null" }, { "parameterName": "_type", "comparison": "isEqualTo", "value": "endpointalerts" } ], "name": "Picker - Threat Hunting Hostname" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "bcdd945e-4dfe-47d6-9489-f76ce012c224", "version": "KqlParameterItem/1.0", "name": "_filehash", "label": "File Hash", "type": 1, "description": "Thish value can be used for searching all alerts for a certain hash", "isRequired": true, "isGlobal": true, "value": "5e54bccbd4d93447e79cda0558b0b308a186c2be571c739e5460a3cb6ef665c0" } ], "style": "formHorizontal", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "conditionalVisibility": { "parameterName": "_type", "comparison": "isEqualTo", "value": "filehash" }, "name": "Search - Threat Hunting Hash" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "0344768b-16c4-44ec-a4ac-73a8bc83d0e2", "version": "KqlParameterItem/1.0", "name": "_CVE", "label": "CVE Number", "type": 1, "description": "Please search on the CVE number", "isRequired": true, "isGlobal": true, "value": "T15" } ], "style": "formHorizontal", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "conditionalVisibility": { "parameterName": "_type", "comparison": "isEqualTo", "value": "CVE" }, "name": "Search - Threat Hunting CVE" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "JamfProtectAlerts\n| where TargetProcessSHA1 has \"{_filehash:value}\" or TargetBinarySHA256 has \"{_filehash:value}\"\n| project-reorder\n TimeGenerated\n| sort by TimeGenerated", "size": 4, "title": "Matches on FileHash", "noDataMessage": "No matches found based on the hash value", "timeContextFromParameter": "_timetoken", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "EventReportUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Click to navigate to original event in Jamf Protect" } } ] } }, "conditionalVisibilities": [ { "parameterName": "_filehash", "comparison": "isNotEqualTo", "value": "null" }, { "parameterName": "_type", "comparison": "isEqualTo", "value": "filehash" } ], "name": "Query - Threat Hunting Hash" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "jamfprotectalerts_CL\n| where input.match.tags contains \"{_CVE:value}\"\n| project-reorder\n TimeGenerated\n| sort by TimeGenerated", "size": 1, "title": "Matches on CVE", "noDataMessage": "No matches found based on the _CVE:value CVE number", "timeContextFromParameter": "_timetoken", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "EventReportUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Click to nagivate to original event in Jamf Protect" } } ] } }, "conditionalVisibilities": [ { "parameterName": "_cve", "comparison": "isNotEqualTo", "value": "null" }, { "parameterName": "_type", "comparison": "isEqualTo", "value": "CVE" } ], "name": "Query - Threat Hunting CVE" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "jamfprotectalerts_CL\n| where input.match.tags contains \"MITREattack\"\n| extend\n Tactics = case(input.match.tags has \"Execution\", \"Execution\", input.match.tags has \"Visibility\", \"Visibility\", input.match.tags has \"Persistence\", \"Persistence\", input.match.tags has \"LateralMovement\", \"Lateral Movement\", input.match.tags has \"CredentialAccess\", \"Credential Acccess\", input.match.tags has \"DefenseEvasion\", \"Defense Evasion\", input.match.tags has \"PrivilegeEscalation\", \"Privilege Escalation\", input.match.tags has \"Impact\", \"Impact\", input.match.tags has \"CommandAndControl\", \"Command and Control\", input.match.tags has \"Discovery\", \"Discovery\", input.match.tags has \"InitialAccess\", \"Initial Access\", \"\"),\n Techniques = extract(@\"[A-Za-z]\\d{4}\", 0, tostring(input.match.tags))\n| project-reorder\n TimeGenerated\n| sort by TimeGenerated", "size": 1, "title": "Alerts mapped to MITRE", "noDataMessage": "No alerts found that are mapped to the MITRE framework", "timeContextFromParameter": "_timetoken", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "EventReportUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Click to navigate to original event in Jamf Protect" } } ], "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 1 } ] }, "conditionalVisibilities": [ { "parameterName": "_type", "comparison": "isNotEqualTo", "value": "null" }, { "parameterName": "_type", "comparison": "isEqualTo", "value": "mitre" } ], "name": "Query - Threat Hunting MITRE" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "JamfProtectAlerts\n| where DvcHostname contains \"{_hostnamealert:value}\"\n| project-reorder\n TimeGenerated\n| sort by TimeGenerated\n| limit 10", "size": 1, "title": "Recent 10 alerts in the past {_timetoken:value} for {_hostnamealert:value}", "noDataMessage": "No alerts found", "timeContextFromParameter": "_timetoken", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "EventReportUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Click to nagivage to original event in Jamf Protect" } } ], "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 1 } ] }, "conditionalVisibilities": [ { "parameterName": "_type", "comparison": "isNotEqualTo", "value": "null" }, { "parameterName": "_type", "comparison": "isEqualTo", "value": "endpointalerts" }, { "parameterName": "_hostnamealert", "comparison": "isNotEqualTo", "value": "" } ], "name": "Query - Threat Hunting 10 Recent Alerts Endpoint" } ] }, "customWidth": "100", "name": "Group - Threat Hunting", "styleSettings": { "margin": "200", "padding": "200", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "JamfProtectAlerts\n| where EventSeverity != \"Informational\"\n| sort by TimeGenerated\n| limit 10", "size": 0, "title": "Recent 10 alerts in the past {_timetoken:value}", "noDataMessage": "No alerts found", "timeContextFromParameter": "_timetoken", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "EventReportUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Click to navigate to Alert in Jamf Protect" } }, { "columnMatch": "AlertURL", "formatter": 7, "formatOptions": { "linkTarget": "Url" } } ], "filter": true, "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "TimeGenerated", "sortOrder": 1 } ] }, "name": "Query - 10 Recent Alerts" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "datatable (Count: long, severity: string) [\n 0, \"Informational\",\n 0, \"Low\",\n 0, \"Medium\",\n 0, \"High\"\n]\n| union\n (\n JamfProtectAlerts\n | summarize Count = count() by EventSeverity\n )\n| where isnotempty(EventSeverity)\n| summarize Count=sum(Count) by EventSeverity", "size": 3, "title": "All Alerts {_timetoken:value}", "timeContextFromParameter": "_timetoken", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "EventSeverity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Informational", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "{0}{1}" }, { "operator": "Default", "representation": "green", "text": "{0}{1}" } ], "compositeBarSettings": { "labelText": "" } } }, "leftContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true, "minimumSignificantDigits": 1, "maximumSignificantDigits": 3 }, "emptyValCustomText": "0" } }, "showBorder": true, "sortCriteriaField": "Count", "sortOrderField": 2 } }, "name": "Datatable - Alerts per Severity" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "JamfProtectAlerts\n| where isnotempty(EventSeverity)\n| summarize count() by EventSeverity, bin(TimeGenerated,{_timetoken:grain})\n| render areachart ", "size": 0, "title": "Events Detected (Count By Severity) {_timetoken:value}", "timeContextFromParameter": "_timetoken", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "chartSettings": { "showLegend": true, "seriesLabelSettings": [ { "seriesName": "0", "label": "Informational" }, { "seriesName": "1", "label": "Low" }, { "seriesName": "2", "label": "Medium" }, { "seriesName": "3", "label": "High" } ] } }, "customWidth": "50", "name": "Query - Events detected by Severity" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "JamfProtectUnifiedLogs\n| summarize count() by tostring(EventMessage), bin(TimeGenerated,{_timetoken:grain})\n| render areachart ", "size": 0, "title": "Unified Logging Events {_timetoken:value}", "timeContextFromParameter": "_timetoken", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "customWidth": "50", "name": "Query - Unified Logs", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "JamfProtectAlerts\n| where isnotempty(DvcHostname)\n| summarize Event = count() by tostring(DvcHostname)\n| sort by Event desc", "size": 3, "title": "Most Active Endpoints (Total, last {_timetoken:value})", "timeContextFromParameter": "_timetoken", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "HostName", "formatter": 1 }, "leftContent": { "columnMatch": "Event", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "HostName", "formatter": 1 }, "centerContent": { "columnMatch": "Event", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } } }, "customWidth": "100", "name": "Query - Most active endpoints with Alerts", "styleSettings": { "maxWidth": "100" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "JamfProtectAlerts\n| summarize Events = count() by EventProduct, bin(TimeGenerated,{_timetoken:grain})\n| render columnchart ", "size": 0, "title": "Events detected (Total by date, {_timetoken:value})", "timeContextFromParameter": "_timetoken", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "chartSettings": { "seriesLabelSettings": [ { "seriesName": "jamfprotect_CL", "label": "Jamf Protect" } ] } }, "customWidth": "50", "name": "Query - Total events detected", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "JamfProtectAlerts\n| summarize Events = count() by EventType, bin(TimeGenerated,{_timetoken:grain})\n| render areachart with(kind=stacked)\n", "size": 0, "title": "Events Detected (Count by Type, {_timetoken:value})", "timeContextFromParameter": "_timetoken", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart", "gridSettings": { "sortBy": [ { "itemKey": "Events", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "Events", "sortOrder": 2 } ] }, "customWidth": "50", "name": "Query - Events detected counted by Type", "styleSettings": { "maxWidth": "50" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "JamfProtectAlerts\n| where isnotempty(EventType)\n| summarize count() by tostring(EventType), tostring(EventMessage)\n| project-rename Count = count_\n| sort by Count desc\n| limit 10\n", "size": 3, "showAnalytics": true, "title": "Top 10 Event Types {_timetoken:value}", "timeContextFromParameter": "_timetoken", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "customWidth": "50", "name": "Query - Top 10 Events", "styleSettings": { "maxWidth": "50" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Device Controls", "expandable": true, "expanded": true, "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "JamfProtectAlerts\n| where EventType == \"UsbBlock\"\n| where EventMessage == \"EnforcedRemovableDevicePolicy\"\n| extend EventMessage = replace_string(tostring(EventMessage), \"EnforcedRemovableDevicePolicy\", \"Blocked\")\n| summarize count() by tostring(EventMessage)\n\n", "size": 2, "title": "Device Controls Blocked {_timetoken:value}", "timeContextFromParameter": "_timetoken", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart", "tileSettings": { "titleContent": { "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "thresholdValue": "Alerts", "text": "{0}{1}" }, { "operator": "Default", "representation": "Notifications", "text": "Devices Blocked" } ] } }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": true, "sortOrderField": 2 }, "graphSettings": { "type": 0, "centerContent": { "columnMatch": "count_", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "showMetrics": false }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "count_", "sizeAggregation": "Sum", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "count_", "heatmapPalette": "greenRed" } } }, "customWidth": "25", "name": "Query - Blocked USB Events", "styleSettings": { "maxWidth": "25" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "JamfProtectAlerts\n| where EventType == \"UsbBlock\"\n| where EventMessage == \"EnforcedRemovableDevicePolicy\"\n| extend device_ = strcat(input.match.event.device.vendorName, \" \",input.match.event.device.productName)\n| summarize count() by tostring(DvcHostname), device_\n| project-rename Hostname = DvcHostname, Device = device_, Count = count_\n| sort by Count desc\n\n", "size": 0, "title": "Device Controls Endpoint {_timetoken:value}", "timeContextFromParameter": "_timetoken", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "customWidth": "65", "name": "Query - Blocked USB Devices", "styleSettings": { "maxWidth": "100" } } ] }, "name": "Group - Device Controls", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Endpoint Telemetry", "expandable": true, "expanded": true, "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "JamfProtectTelemetry\n| where eventTypeHuman == \"exec\"\n| limit 50\n| sort by TimeGenerated", "size": 0, "title": "Succesful sudo events {_timetoken:value}", "noDataMessage": "No events occured", "timeContextFromParameter": "_timetoken", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Compiled_Arguments", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "69.5714ch" } } ] }, "sortBy": [] }, "name": "Query - Successful sudo events" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "JamfProtectTelemetry\n| where eventTypeHuman contains \"screensharing\"\n| limit 15\n| sort by TimeGenerated", "size": 0, "title": "Remotely Controlled Commands (Outbound) {_timetoken:value}", "noDataMessage": "No events occured", "timeContextFromParameter": "_timetoken", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "name": "Query - Remotely Controlled Commands" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Endpoint Information", "expandable": true, "expanded": true, "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Log Parser {_timetoken:value}", "expandable": true, "expanded": true, "items": [ { "type": 1, "content": { "json": "Please select a hostname in order to show the collected plain-text log files.", "style": "info" }, "conditionalVisibility": { "parameterName": "_hostnamelogparser", "comparison": "isEqualTo" }, "name": "Text - Jamf Log Parser Note", "styleSettings": { "showBorder": true } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "f747e125-851e-45f7-b500-5d22049da6a6", "version": "KqlParameterItem/1.0", "name": "_hostnamelogparser", "label": "Hostname", "type": 2, "isRequired": true, "query": "JamfProtectTelemetry\n| where isnotempty(DvcHostname)\n and eventTypeHuman == \"log_collection\"\n| project-keep DvcHostname\n| project-rename Hostname = DvcHostname\n| summarize by tostring(Hostname)", "crossComponentResources": [ "{Workspace}" ], "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "_timetoken", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null }, { "id": "7d123ad2-1768-4d22-b438-565ab483c044", "version": "KqlParameterItem/1.0", "name": "_logselectlogparser", "label": "Available Log File", "type": 2, "isRequired": true, "query": "JamfProtectTelemetry\n| where eventTypeHuman == \"log_collection\"\n and DvcHostname == \"{_hostnamelogparser:value}\"\n| project-keep TargetFilePath\n| project-keep TargetFilePath\n| extend TargetFilePath = replace_string(TargetFilePath, \"[\", \"\")\n| extend TargetFilePath = replace_string(TargetFilePath, \"]\", \"\")\n| extend TargetFilePath = replace_string(TargetFilePath, '\"', \"\")\n| summarize by TargetFilePath", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "_timetoken", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "40", "name": "Picker - Hostname" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "JamfProtect\n| where EventType == \"LogFileCollected\"\n and DvcHostname == \"{_hostnamelogparser:value}\"\n| extend TargetFilePath = replace_string(TargetFilePath, \"[\", \"\")\n| extend TargetFilePath = replace_string(TargetFilePath, \"]\", \"\")\n| extend TargetFilePath = replace_string(TargetFilePath, '\"', \"\")\n| where TargetFilePath == \"{_logselectlogparser:escapejson}\"\n| project EventResult, EventStartTime\n| project-rename Logs = EventResult\n| project-reorder EventStartTime, Logs\n| mv-expand parse_json(Logs)\n| sort by EventStartTime desc\n| limit 50", "size": 0, "showAnalytics": true, "title": "Log File Collection on \"{_hostnamelogparser:value}\"", "noDataMessage": "No matches found based on the hostname", "timeContextFromParameter": "_timetoken", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Logs", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "150ch" } } ] } }, "conditionalVisibility": { "parameterName": "_hostnamelogparser", "comparison": "isNotEqualTo" }, "name": "Query - Parse Logs" } ] }, "customWidth": "100", "name": "Group - Log Parser", "styleSettings": { "margin": "200", "padding": "200", "showBorder": true } } ] }, "name": "Group - Endpoint Information" } ] }, "name": "Group - Telemetry", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Network Threat Events", "expandable": true, "expanded": true, "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "JamfProtect\n| where EventProduct == \"Jamf Protect - Threat Events Stream\"\n and EventResult == \"Blocked\"\n| extend blocks = case(EventResult == \"Blocked\", \"Blocked\", \"True\")\n| summarize arg_max(EventResult, *) by EventStartTime\n| summarize Count = count() by blocks\n\n", "size": 4, "title": "Threats blocked by NTP {_timetoken:value}", "timeContextFromParameter": "_timetoken", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Count", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "0", "representation": "green", "text": "Threats blocked by NTP" }, { "operator": "<", "thresholdValue": "15", "representation": "gray", "text": "Threats blocked by NTP" }, { "operator": "<", "thresholdValue": "30", "representation": "orange", "text": "Threats blocked by NTP" }, { "operator": ">", "thresholdValue": "50", "representation": "redBright", "text": "Threats blocked by NTP" }, { "operator": "Default", "representation": "gray", "text": "Threats blocked by NTP" } ], "compositeBarSettings": { "labelText": "" } } }, "leftContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": true, "minimumSignificantDigits": 1, "maximumSignificantDigits": 3 }, "emptyValCustomText": "0" } }, "showBorder": true, "sortCriteriaField": "blocks", "sortOrderField": 1, "size": "auto" } }, "name": "Query - Threats blocked by NTP" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "JamfProtect\n| where EventProduct == \"Jamf Protect - Threat Events Stream\"\n| where isnotempty(EventSeverity)\n| summarize arg_max(EventSeverity, *) by EventStartTime\n| summarize count() by EventSeverity, bin(TimeGenerated,{_timetoken:grain})\n| render areachart", "size": 0, "title": "Network Events Detected (Count By Severity) {_timetoken:value}", "timeContextFromParameter": "_timetoken", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "customWidth": "50", "name": "Query - Network Events by Severity" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "JamfProtect\n| where EventProduct == \"Jamf Protect - Threat Events Stream\"\n and isnotempty(DvcHostname)\n| summarize arg_max(DvcHostname, *) by EventStartTime\n| summarize Event = count() by DvcHostname\n| sort by Event desc", "size": 0, "title": "Most Active Endpoints (Total, last {_timetoken:value})", "timeContextFromParameter": "_timetoken", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "customWidth": "50", "name": "Query - Most Active Endoints with Alerts" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "JamfProtect\n| where EventProduct == \"Jamf Protect - Threat Events Stream\"\n and isnotempty(ThreatCategory)\n| summarize arg_max(ThreatCategory, *) by EventStartTime\n| summarize Events = count() by ThreatCategory, bin(EventStartTime, {_timetoken:grain})\n| render areachart with(kind=stacked)", "size": 0, "title": "Network Events Detected (Count by Type, {_timetoken:value})", "timeContextFromParameter": "_timetoken", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "customWidth": "50", "name": "Query - Network Events by Category" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "JamfProtect\n| where EventProduct == \"Jamf Protect - Threat Events Stream\"\n and isnotempty(ThreatCategory)\n| summarize arg_max(ThreatCategory, *) by EventStartTime\n| summarize Events = count() by ThreatCategory\n| render piechart", "size": 0, "title": "Event Types {_timetoken:value}", "timeContextFromParameter": "_timetoken", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "customWidth": "50", "name": "Query - Network Events by Description" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "JamfProtect\n| where EventProduct == \"Jamf Protect - Threat Events Stream\" \n and notempty(ThreatCategory) and notempty(DnsQueryName)\n| extend name_ = ThreatCategory\n| summarize arg_max(DnsQueryName, *) by EventStartTime\n| summarize count() by DnsQueryName, ThreatCategory\n| project-rename\n Count = count_\n| sort by Count desc\n| limit 10", "size": 0, "title": "Top 10 Blocked destinations {_timetoken:value}", "timeContextFromParameter": "_timetoken", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "customWidth": "50", "name": "Query - Top 10 blocked destinations" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "JamfProtect\n| where EventProduct == \"Jamf Protect - Threat Events Stream\" \n and notempty(ThreatCategory)\n and notempty(DstIpAddr)\n| extend name_ = ThreatCategory\n| summarize arg_max(DstIpAddr, *) by EventStartTime\n| summarize count() by DstIpAddr\n| project-rename\n Count = count_\n| sort by Count desc\n| limit 10", "size": 0, "title": "Top 10 Blocked IPs {_timetoken:value}", "timeContextFromParameter": "_timetoken", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "customWidth": "50", "name": "Query - Top 10 Blocked IPs" } ] }, "name": "Network Threat Events - Group", "styleSettings": { "showBorder": true } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Network Traffic", "expandable": true, "expanded": true, "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "JamfProtect\n| where EventProduct == \"Jamf Protect - Network Traffic Stream\"\n and isnotempty(DnsQuery)\n| summarize arg_max(DnsQuery, *) by EventStartTime\n| summarize count() by DnsQuery, DnsQueryTypeName\n| project-rename\n Count = count_\n| sort by Count desc\n| limit 10", "size": 0, "title": "Top 10 resolved destinations {_timetoken:value}", "timeContextFromParameter": "_timetoken", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "customWidth": "50", "name": "Query - Top 10 resolved destinations" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "JamfProtect\n| where EventProduct == \"Jamf Protect - Network Traffic Stream\"\n and isnotempty(DstIpAddr) and DstIpAddr != \"[]\"\n| summarize arg_max(DstIpAddr, *) by EventStartTime\n| summarize count() by DstIpAddr\n| project-rename\n Count = count_\n| sort by Count desc\n| limit 10", "size": 0, "title": "Top 10 Resolved IPs {_timetoken:value}", "timeContextFromParameter": "_timetoken", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "customWidth": "50", "name": "Query - Top 10 Resolved IPs" } ] }, "name": "Network Traffic - Group", "styleSettings": { "showBorder": true } } ], "fromTemplateId": "sentinel-JamfProtectDashboard", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }