{ "version": "Notebook/1.0", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "tabStyle": "bigger", "links": [ { "id": "8a6b28d2-1a76-4910-9604-bd85687834b1", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Insights", "subTarget": "InsightsTab", "style": "link" }, { "id": "927c82f0-55df-4627-a888-90d23355053f", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Policies", "subTarget": "PoliciesTab", "style": "link" }, { "id": "a140ce04-bf56-4905-88a4-0bffe2722465", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "MFA", "subTarget": "MFATab", "style": "link" }, { "id": "e39087e2-621e-4c9a-af85-f654bf14ba81", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Events", "subTarget": "EventsTab", "style": "link" } ] }, "name": "Tabs" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "8254e969-e553-4735-944d-cede104bc764", "version": "KqlParameterItem/1.0", "name": "Timeframe", "type": 4, "description": "Time range", "isRequired": true, "isGlobal": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 604800000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isNotEqualTo", "value": "InsightsTab" }, "name": "parameters - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog \n| where DeviceVendor has 'Silverfort'\n| where DeviceProduct has 'Admin Console'\n| extend Vendor = DeviceVendor\n| extend Product = DeviceProduct\n| extend ProductVersion = DeviceVersion\n| extend Severity = LogSeverity\n| extend SrcIpAddr = SourceIP\n| extend SrcHostname = SourceHostName\n| extend SrcUserName = SourceUserName\n| extend Message = Message\n| extend SubType = DeviceEventClassID\n| extend Type = Activity\n| extend DstUserName = DestinationUserID\n| extend SilverfortReqRisk = DeviceCustomString1\n| extend SilverfortReqResult = DeviceCustomString2\n| extend SilverfortPolicyAction = DeviceCustomString3\n| extend SilverfortPolicyId = DeviceCustomString4\n| extend SilverfortMfaResponse = DeviceCustomString5\n| extend SilverfortMfaResponseTime = DeviceCustomString6\n| extend SilverfortRiskIndicators = extract('cs7=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)\n| extend SilverfortPolicyName = extract('cs8=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)\n| extend DstGeoCountry = extract('cs9=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)\n| extend SilverfortCityOrigin = extract('cs10=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)\n| extend SilverfortCoordinatesOrigin = extract('cs11=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)\n| extend DvcHostname = DeviceAddress\n| where isnotempty(SilverfortReqRisk)\n| summarize Count = count() by SilverfortReqRisk", "size": 4, "title": "Events by Risk Level", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "SilverfortReqRisk", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": true } }, "name": "query - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\n| where TimeGenerated {Timeframe}\n| extend RiskIndicators = extract('cs7=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)\n| mv-expand RiskIndicators = split(RiskIndicators, \",\")\n| extend RiskIndicators = tostring(RiskIndicators)\n| extend RiskIndicators = toupper(RiskIndicators) \n| where RiskIndicators != \"\" and RiskIndicators != \"N/A\" \n| summarize Count = count() by RiskIndicators", "size": 0, "title": "Events by Risk Indicators (Based on Timeframe)", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "RiskIndicators", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": true } }, "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\n| where TimeGenerated {Timeframe}\n| extend RiskIndicators = extract('cs7=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)\n| mv-expand RiskIndicators = split(RiskIndicators, \",\")\n| extend RiskIndicators = tostring(RiskIndicators)\n| extend RiskIndicators = toupper(RiskIndicators) \n| where RiskIndicators != \"\" and RiskIndicators != \"N/A\" \n| summarize Count = count() by bin(TimeGenerated, 1h), RiskIndicators // Group by 1hr and risk indicator\n| render timechart\n", "size": 0, "title": "Events by Risk Indicators Timechart", "timeContextFromParameter": "Timeframe", "timeBrushParameterName": "TimeBrushRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 1" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "f9081b22-d129-45b4-a6ca-8039192da441", "version": "KqlParameterItem/1.0", "name": "ThreatIndicatorType", "label": "Risk Indicator", "type": 2, "isGlobal": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\n {\n \"value\": \"Abnormal_authentication_detected\",\n \"label\": \"Abnormal Authentication\"\n },\n {\n \"value\": \"Abnormal_Geolocation\",\n \"label\": \"Abnormal Geolocation\"\n },\n {\n \"value\": \"Abnormal_MFA_activity\",\n \"label\": \"Abnormal MFA Activity\"\n },\n {\n \"value\": \"Admin_with_SPN\",\n \"label\": \"Admin with SPN\"\n },\n {\n \"value\": \"Anonymous_IP\",\n \"label\": \"Anonymous IP\"\n },\n {\n \"value\": \"Suspected_AS-REP_Roasting\",\n \"label\": \"Suspected AS-REP Roasting\"\n },\n {\n \"value\": \"Azure_Risky_User\",\n \"label\": \"Azure Risky User\"\n },\n {\n \"value\": \"Bad_checksum_in_Kerberos\",\n \"label\": \"Bad Checksum in Kerberos\"\n },\n {\n \"value\": \"Authentication_spike\",\n \"label\": \"Authentication Spike\"\n },\n {\n \"value\": \"Azure_threatIntelligence\",\n \"label\": \"Azure Threat Intelligence\"\n },\n {\n \"value\": \"Suspected_Kerberoasting\",\n \"label\": \"Suspected Kerberoasting\"\n },\n {\n \"value\": \"Suspected_MFA_Bombing\",\n \"label\": \"Suspected MFA Bombing\"\n },\n {\n \"value\": \"Unusual_server_use\",\n \"label\": \"Unusual Server Use\"\n },\n {\n \"value\": \"NTLMv1_Authentication\",\n \"label\": \"NTLMv1 Authentication\"\n },\n {\n \"value\": \"Suspected_brute_force_attack_on_the_user\",\n \"label\": \"Suspected User Brute Force\"\n },\n {\n \"value\": \"Suspected_Certifried_exploit\",\n \"label\": \"Suspected Certifried Exploit\"\n },\n {\n \"value\": \"Credential_scanning\",\n \"label\": \"Credential Scanning\"\n },\n {\n \"value\": \"Daily_abnormal_authentication_activity\",\n \"label\": \"Daily Abnormal Authentication Activity\"\n },\n {\n \"value\": \"Domain_admin\",\n \"label\": \"Domain Admin\"\n },\n {\n \"value\": \"Hourly_abnormal_authentication_activity\",\n \"label\": \"Hourly Abnormal Authentication Activity\"\n },\n {\n \"value\": \"Interactive_login\",\n \"label\": \"Interactive Login\"\n },\n {\n \"value\": \"Service_account_interactive_login\",\n \"label\": \"Service Account Interactive Login\"\n },\n {\n \"value\": \"Impossible_Travel\",\n \"label\": \"Impossible Travel\"\n },\n {\n \"value\": \"SPN_Reconnaissance\",\n \"label\": \"SPN Reconnaissance\"\n },\n {\n \"value\": \"Leaked_credentials\",\n \"label\": \"Leaked Credentials\"\n },\n {\n \"value\": \"Log4Shell_exploit_attempts\",\n \"label\": \"Log4Shell Exploit Attempt\"\n },\n {\n \"value\": \"Forbidden_characters_were_used\",\n \"label\": \"Forbidden Characters Were Used\"\n },\n {\n \"value\": \"Suspected_Payload_Injection\",\n \"label\": \"Suspected Payload Injection\"\n },\n {\n \"value\": \"Malicious_IP\",\n \"label\": \"Malicious IP\"\n },\n {\n \"value\": \"New_Account\",\n \"label\": \"New Account\"\n },\n {\n \"value\": \"New_Server\",\n \"label\": \"New Server\"\n },\n {\n \"value\": \"Suspected_\\\"NoPac\\\"_breach\",\n \"label\": \"Suspected NoPac Breach\"\n },\n {\n \"value\": \"Suspected_NoPac_TGT_was_used\",\n \"label\": \"Suspected NoPac TGT Was Used\"\n },\n {\n \"value\": \"Old_operating_system\",\n \"label\": \"Old Operating System\"\n },\n {\n \"value\": \"User_with_old_password\",\n \"label\": \"User with Old Password\"\n },\n {\n \"value\": \"Privileged_user\",\n \"label\": \"Privileged User\"\n },\n {\n \"value\": \"Unprivileged_User_as_DNS_Admin\",\n \"label\": \"Unprivileged User as DNS Admin\"\n },\n {\n \"value\": \"Resource_is_at_high_risk\",\n \"label\": \"Resource is at High Risk\"\n },\n {\n \"value\": \"Resource_is_at_critical_risk\",\n \"label\": \"Resource is at Critical Risk\"\n },\n {\n \"value\": \"Shared_account\",\n \"label\": \"Shared Account\"\n },\n {\n \"value\": \"Abnormal_site\",\n \"label\": \"Abnormal Site\"\n },\n {\n \"value\": \"Suspected_SMB_Enumeration\",\n \"label\": \"Suspected SMB Enumeration\"\n },\n {\n \"value\": \"Stale_user\",\n \"label\": \"Stale User\"\n },\n {\n \"value\": \"Suspected_brute_force_attack_on_the_server\",\n \"label\": \"Suspected Server Brute Force\"\n },\n {\n \"value\": \"Stale_user_activity\",\n \"label\": \"Stale User Activity\"\n },\n {\n \"value\": \"Shadow_admin\",\n \"label\": \"Shadow Admin\"\n },\n {\n \"value\": \"Stale_resource\",\n \"label\": \"Stale Device\"\n },\n {\n \"value\": \"Shared_device\",\n \"label\": \"Shared Device\"\n },\n {\n \"value\": \"Suspected_brute_force_attack_from_the_host\",\n \"label\": \"Suspected Brute Force from Host\"\n },\n {\n \"value\": \"Failed_Authentications_Batch\",\n \"label\": \"Failed Authentications Batch\"\n },\n {\n \"value\": \"Suspected_service_account\",\n \"label\": \"Suspected Service Account\"\n },\n {\n \"value\": \"User_is_at_high_risk\",\n \"label\": \"User is at High Risk\"\n },\n {\n \"value\": \"User_is_at_critical_risk\",\n \"label\": \"User is at Critical Risk\"\n },\n {\n \"value\": \"User_locked\",\n \"label\": \"Locked Account\"\n },\n {\n \"value\": \"User_with_SPN\",\n \"label\": \"User with SPN\"\n },\n {\n \"value\": \"Unfamiliar_sign-in\",\n \"label\": \"Unfamiliar Sign-in\"\n },\n {\n \"value\": \"Weakly_encrypted_ticket\",\n \"label\": \"Weakly Encrypted Ticket\"\n },\n {\n \"value\": \"Weakly_encrypted_reply\",\n \"label\": \"Weakly Encrypted Reply\"\n },\n {\n \"value\": \"User_authenticated_frequently_with_weak_encryption\",\n \"label\": \"User Authenticated Frequently with Weak Encryption\"\n },\n {\n \"value\": \"Weak_encryption_frequently_used_in_the_server\",\n \"label\": \"Weak Encryption Frequently Used in the Server\"\n },\n {\n \"value\": \"Login_by_built-in_Guest_account\",\n \"label\": \"Login by Built-in Guest Account\"\n },\n {\n \"value\": \"Login_by_built-in_Administrator_account\",\n \"label\": \"Login by Built-in Administrator Account\"\n },\n {\n \"value\": \"Historic_Encryption_Type\",\n \"label\": \"Historic Encryption Type\"\n },\n {\n \"value\": \"Computer_Account_in_Privileged_Group\",\n \"label\": \"Computer Account in Privileged Group\"\n },\n {\n \"value\": \"Suspected_Netlogon_RPC_Privilege_Elevation\",\n \"label\": \"Suspected Netlogon RPC Privilege Elevation\"\n },\n {\n \"value\": \"Print_Nightmare_Fix_Artifact\",\n \"label\": \"Print Nightmare Fix Artifact\"\n },\n {\n \"value\": \"Service_for_User_to_Self_(S4U2self)_extension\",\n \"label\": \"Service for User to Self (S4U2self) Extension\"\n },\n {\n \"value\": \"Service_for_User_to_Proxy_(S4U2proxy)_extension\",\n \"label\": \"Service for User to Proxy (S4U2proxy) Extension\"\n },\n {\n \"value\": \"Privileged_account_credential_added_to_RODC\",\n \"label\": \"Privileged Account Credentials in RODC\"\n },\n {\n \"value\": \"Suspected_Sapphire_Ticket\",\n \"label\": \"Suspected Sapphire Ticket\"\n },\n {\n \"value\": \"Ticket_from_New_IP\",\n \"label\": \"Ticket from New IP\"\n }\n]", "timeContext": { "durationMs": 86400000 }, "value": null }, { "id": "cb206dd9-5642-4d5d-9f4f-426bbfe9d8a7", "version": "KqlParameterItem/1.0", "name": "Type", "type": 1, "value": "" }, { "id": "bb80154c-91ea-4a47-a1a3-cbc35983766d", "version": "KqlParameterItem/1.0", "name": "SilverfortReqRisk", "label": "Silverfort Request Risk", "type": 1, "value": "" }, { "id": "52b7241d-956b-49ac-b907-bf10df0f7643", "version": "KqlParameterItem/1.0", "name": "SilverfortReqResult", "label": "Silverfort Request Result", "type": 1, "value": "" }, { "id": "9b9f2d12-5a0b-44e8-a928-875c3e8012e9", "version": "KqlParameterItem/1.0", "name": "SrcIpAddr", "label": "Source IP Address", "type": 1, "value": "" }, { "id": "029d213e-1089-468b-af9c-5272afcaf266", "version": "KqlParameterItem/1.0", "name": "SrcHostname", "label": "Source Hostname", "type": 1 }, { "id": "e84c32b0-4552-4c8e-95e8-d6f31ceec7fa", "version": "KqlParameterItem/1.0", "name": "SrcUserName", "label": "User Name", "type": 1 }, { "id": "2e8f98a0-54dc-4bff-b38d-b1aa9a02d1b2", "version": "KqlParameterItem/1.0", "name": "SilverfortPolicyId", "label": "Silverfort Policy ID", "type": 1 }, { "id": "04dd72fa-1e65-4284-b236-52454bbeae5d", "version": "KqlParameterItem/1.0", "name": "Severity", "type": 1, "value": "" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog \n| where DeviceVendor has 'Silverfort'\n| where DeviceProduct has 'Admin Console'\n| extend Vendor = coalesce(replace('\\\"', '', DeviceVendor), \"n/a\")\n| extend Product = coalesce(replace('\\\"', '', DeviceProduct), \"n/a\")\n| extend ProductVersion = coalesce(replace('\\\"', '', DeviceVersion), \"n/a\")\n| extend Severity = coalesce(replace('\\\"', '', LogSeverity), \"n/a\")\n| extend SrcIpAddr = coalesce(replace('\\\"', '', SourceIP), \"n/a\")\n| extend SrcHostname = coalesce(replace('\\\"', '', SourceHostName), \"n/a\")\n| extend SrcUserName = coalesce(replace('\\\"', '', SourceUserName), \"n/a\")\n| extend Message = coalesce(replace('\\\"', '', Message), \"n/a\")\n| extend SubType = coalesce(replace('\\\"', '', DeviceEventClassID), \"n/a\")\n| extend Type = coalesce(replace('\\\"', '', Activity), \"n/a\")\n| extend DstUserName = coalesce(replace('\\\"', '', DestinationUserID), \"n/a\")\n| extend SilverfortReqRisk = coalesce(replace('\\\"', '', DeviceCustomString1), \"n/a\")\n| extend SilverfortReqResult = coalesce(replace('\\\"', '', DeviceCustomString2), \"n/a\")\n| extend SilverfortPolicyAction = coalesce(replace('\\\"', '', DeviceCustomString3), \"n/a\")\n| extend SilverfortPolicyId = coalesce(replace('\\\"', '', DeviceCustomString4), \"n/a\")\n| extend SilverfortMfaResponse = coalesce(replace('\\\"', '', DeviceCustomString5), \"n/a\")\n| extend SilverfortMfaResponseTime = coalesce(replace('\\\"', '', DeviceCustomString6), \"n/a\")\n| extend SilverfortRiskIndicators = coalesce(replace('\\\"', '', extract('cs7=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)), \"n/a\")\n| extend SilverfortPolicyName = coalesce(replace('\\\"', '', extract('cs8=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)), \"n/a\")\n| extend DstGeoCountry = coalesce(replace('\\\"', '', extract('cs9=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)), \"n/a\")\n| extend SilverfortCityOrigin = coalesce(replace('\\\"', '', extract('cs10=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)), \"n/a\")\n| extend SilverfortCoordinatesOrigin = coalesce(replace('\\\"', '', extract('cs11=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)), \"n/a\")\n| extend DvcHostname = coalesce(replace('\\\"', '', DeviceAddress), \"n/a\")\n| where SilverfortRiskIndicators contains \"{ThreatIndicatorType}\"\n| where (isempty('{Type}') or Type contains '{Type}')\n| where (isempty('{SilverfortReqRisk}') or SilverfortReqRisk contains '{SilverfortReqRisk}')\n| where (isempty('{SilverfortReqResult}') or SilverfortReqResult contains '{SilverfortReqResult}')\n| where (isempty('{SrcIpAddr}') or SrcIpAddr contains '{SrcIpAddr}')\n| where (isempty('{SrcHostname}') or SrcHostname contains '{SrcHostname}')\n| where (isempty('{SrcUserName}') or SrcUserName contains '{SrcUserName}')\n| where (isempty('{SilverfortPolicyId}') or SilverfortPolicyId contains '{SilverfortPolicyId}')\n| where (isempty('{Severity}') or Severity contains '{Severity}')\n| where TimeGenerated {TimeBrushRange}\n| project TimeGenerated\n , Message\n , Type\n , SubType\n , DstUserName\n , DstGeoCountry\n , DvcHostname\n , Severity\n , SrcIpAddr\n , SrcHostname\n , SrcUserName\n , SilverfortReqRisk\n , SilverfortReqResult\n , SilverfortPolicyAction\n , SilverfortPolicyId\n , SilverfortMfaResponse\n , SilverfortMfaResponseTime\n , SilverfortRiskIndicators\n , SilverfortPolicyName\n , SilverfortCityOrigin\n , SilverfortCoordinatesOrigin\n\n", "size": 0, "timeContextFromParameter": "TimeBrushRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 3" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "EventsTab" }, "name": "Threat Indicators" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog \n| where DeviceVendor has 'Silverfort'\n| where DeviceProduct has 'Admin Console'\n| extend Vendor = DeviceVendor\n| extend Product = DeviceProduct\n| extend ProductVersion = DeviceVersion\n| extend Severity = LogSeverity\n| extend SrcIpAddr = SourceIP\n| extend SrcHostname = SourceHostName\n| extend SrcUserName = SourceUserName\n| extend Message = Message\n| extend SubType = DeviceEventClassID\n| extend Type = Activity\n| extend DstUserName = DestinationUserID\n| extend SilverfortReqRisk = DeviceCustomString1\n| extend SilverfortReqResult = DeviceCustomString2\n| extend SilverfortPolicyAction = DeviceCustomString3\n| extend SilverfortPolicyId = DeviceCustomString4\n| extend SilverfortMfaResponse = DeviceCustomString5\n| extend SilverfortMfaResponseTime = DeviceCustomString6\n| extend SilverfortRiskIndicators = extract('cs7=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)\n| extend SilverfortPolicyName = extract('cs8=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)\n| extend DstGeoCountry = extract('cs9=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)\n| extend SilverfortCityOrigin = extract('cs10=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)\n| extend SilverfortCoordinatesOrigin = extract('cs11=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)\n| extend DvcHostname = DeviceAddress\n| where isnotempty(SilverfortPolicyName) and SilverfortPolicyName != \"n/a\"\n| summarize AuthCount = count() by SilverfortPolicyName\n| order by AuthCount desc\n| project SilverfortPolicyName, AuthCount", "size": 0, "title": "Policies (Select One)", "timeContextFromParameter": "Timeframe", "exportFieldName": "SilverfortPolicyName", "exportParameterName": "SelectedPolicy", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "SilverfortPolicyName", "formatter": 1 }, "leftContent": { "columnMatch": "AuthCount", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "SilverfortPolicyName", "formatter": 1 }, "centerContent": { "columnMatch": "AuthCount", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "AuthCount", "sizeAggregation": "Sum", "legendMetric": "AuthCount", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "AuthCount", "heatmapPalette": "greenRed" } } }, "customWidth": "50", "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog \n| where DeviceVendor has 'Silverfort'\n| where DeviceProduct has 'Admin Console'\n| extend Vendor = DeviceVendor\n| extend Product = DeviceProduct\n| extend ProductVersion = DeviceVersion\n| extend Severity = LogSeverity\n| extend SrcIpAddr = SourceIP\n| extend SrcHostname = SourceHostName\n| extend SrcUserName = SourceUserName\n| extend Message = Message\n| extend SubType = DeviceEventClassID\n| extend Type = Activity\n| extend DstUserName = DestinationUserID\n| extend SilverfortReqRisk = DeviceCustomString1\n| extend SilverfortReqResult = DeviceCustomString2\n| extend SilverfortPolicyAction = coalesce(replace('\\\"', '', DeviceCustomString3), \"n/a\")\n| extend SilverfortPolicyId = DeviceCustomString4\n| extend SilverfortMfaResponse = DeviceCustomString5\n| extend SilverfortMfaResponseTime = DeviceCustomString6\n| extend SilverfortRiskIndicators = extract('cs7=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)\n| extend SilverfortPolicyName = extract('cs8=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)\n| extend DstGeoCountry = extract('cs9=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)\n| extend DstGeoCountry = extract('cs9=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)\n| extend SilverfortCityOrigin = extract('cs10=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)\n| extend SilverfortCoordinatesOrigin = extract('cs11=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)\n| extend DvcHostname = DeviceAddress\n| where SilverfortPolicyName == '{SelectedPolicy}'\n| summarize Count = count() by SilverfortPolicyAction\n| project SilverfortPolicyAction, Count", "size": 4, "title": "Policy Action (Select One)", "timeContextFromParameter": "Timeframe", "exportFieldName": "SilverfortPolicyAction", "exportParameterName": "SelectedAction", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "sortBy": [ { "itemKey": "SilverfortPolicyAction", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "SilverfortPolicyAction", "sortOrder": 1 } ] }, "customWidth": "50", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog \n| where DeviceVendor has 'Silverfort'\n| where DeviceProduct has 'Admin Console'\n| extend Vendor = coalesce(replace('\\\"', '', DeviceVendor), \"n/a\")\n| extend Product = coalesce(replace('\\\"', '', DeviceProduct), \"n/a\")\n| extend ProductVersion = coalesce(replace('\\\"', '', DeviceVersion), \"n/a\")\n| extend Severity = coalesce(replace('\\\"', '', LogSeverity), \"n/a\")\n| extend SrcIpAddr = coalesce(replace('\\\"', '', SourceIP), \"n/a\")\n| extend SrcHostname = coalesce(replace('\\\"', '', SourceHostName), \"n/a\")\n| extend SrcUserName = coalesce(replace('\\\"', '', SourceUserName), \"n/a\")\n| extend Message = coalesce(replace('\\\"', '', Message), \"n/a\")\n| extend SubType = coalesce(replace('\\\"', '', DeviceEventClassID), \"n/a\")\n| extend Type = coalesce(replace('\\\"', '', Activity), \"n/a\")\n| extend DstUserName = coalesce(replace('\\\"', '', DestinationUserID), \"n/a\")\n| extend DstUserName = coalesce(replace('\\\"', '', DestinationUserID), \"n/a\")\n| extend SilverfortReqRisk = coalesce(replace('\\\"', '', DeviceCustomString1), \"n/a\")\n| extend SilverfortReqResult = coalesce(replace('\\\"', '', DeviceCustomString2), \"n/a\")\n| extend SilverfortPolicyAction = coalesce(replace('\\\"', '', DeviceCustomString3), \"n/a\")\n| extend SilverfortPolicyId = coalesce(replace('\\\"', '', DeviceCustomString4), \"n/a\")\n| extend SilverfortMfaResponse = coalesce(replace('\\\"', '', DeviceCustomString5), \"n/a\")\n| extend SilverfortMfaResponseTime = coalesce(replace('\\\"', '', DeviceCustomString6), \"n/a\")\n| extend SilverfortRiskIndicators = extract('cs7=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)\n| extend SilverfortPolicyName = extract('cs8=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)\n| extend DstGeoCountry = extract('cs9=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)\n| extend DstGeoCountry = extract('cs9=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)\n| extend SilverfortCityOrigin = extract('cs10=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)\n| extend SilverfortCoordinatesOrigin = extract('cs11=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)\n| extend DvcHostname = DeviceAddress\n| where SilverfortPolicyName == '{SelectedPolicy}'\n| where SilverfortPolicyAction like '{SelectedAction}'\n| project TimeGenerated, SrcUserName, SrcHostname, SrcIpAddr, DstUserName, SilverfortReqResult, SilverfortPolicyAction, SilverfortMfaResponse", "size": 0, "title": "Related Events", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 2" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "PoliciesTab" }, "name": "Policies" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog \n| where DeviceVendor has 'Silverfort'\n| where DeviceProduct has 'Admin Console'\n| extend SubType = DeviceEventClassID\n| extend SilverfortMfaResponse = DeviceCustomString5\n| extend DvcHostname = DeviceAddress\n| where TimeGenerated {Timeframe} \n| where SubType == \"MFA\"\n| where SilverfortMfaResponse has \"Blocked\" or SilverfortMfaResponse has \"Timed Out\" \n| summarize Count = count() by bin(TimeGenerated, 1h), SilverfortMfaResponse \n| render timechart", "size": 0, "title": "Denied (Blocked & Timeouts) MFAs", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog \n| where DeviceVendor has 'Silverfort'\n| where DeviceProduct has 'Admin Console'\n| extend Vendor = coalesce(replace('\\\"', '', DeviceVendor), \"n/a\")\n| extend Product = coalesce(replace('\\\"', '', DeviceProduct), \"n/a\")\n| extend ProductVersion = coalesce(replace('\\\"', '', DeviceVersion), \"n/a\")\n| extend Severity = coalesce(replace('\\\"', '', LogSeverity), \"n/a\")\n| extend SrcIpAddr = coalesce(replace('\\\"', '', SourceIP), \"n/a\")\n| extend SrcHostname = coalesce(replace('\\\"', '', SourceHostName), \"n/a\")\n| extend SrcUserName = coalesce(replace('\\\"', '', SourceUserName), \"n/a\")\n| extend Message = coalesce(replace('\\\"', '', Message), \"n/a\")\n| extend SubType = coalesce(replace('\\\"', '', DeviceEventClassID), \"n/a\")\n| extend Type = coalesce(replace('\\\"', '', Activity), \"n/a\")\n| extend DstUserName = coalesce(replace('\\\"', '', DestinationUserID), \"n/a\")\n| extend SilverfortReqRisk = coalesce(replace('\\\"', '', DeviceCustomString1), \"n/a\")\n| extend SilverfortReqResult = coalesce(replace('\\\"', '', DeviceCustomString2), \"n/a\")\n| extend SilverfortPolicyAction = coalesce(replace('\\\"', '', DeviceCustomString3), \"n/a\")\n| extend SilverfortPolicyId = coalesce(replace('\\\"', '', DeviceCustomString4), \"n/a\")\n| extend SilverfortMfaResponse = coalesce(replace('\\\"', '', DeviceCustomString5), \"n/a\")\n| extend SilverfortMfaResponseTime = coalesce(replace('\\\"', '', DeviceCustomString6), \"n/a\")\n| extend SilverfortRiskIndicators = coalesce(replace('\\\"', '', extract('cs7=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)), \"n/a\")\n| extend SilverfortPolicyName = coalesce(replace('\\\"', '', extract('cs8=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)), \"n/a\")\n| extend DstGeoCountry = coalesce(replace('\\\"', '', extract('cs9=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)), \"n/a\")\n| extend SilverfortCityOrigin = coalesce(replace('\\\"', '', extract('cs10=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)), \"n/a\")\n| extend SilverfortCoordinatesOrigin = coalesce(replace('\\\"', '', extract('cs11=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)), \"n/a\")\n| extend DvcHostname = coalesce(replace('\\\"', '', DeviceAddress), \"n/a\")\n| where SilverfortMfaResponse has \"Blocked\"\n| summarize Count = count() by SrcUserName\n| project SrcUserName, Count", "size": 0, "title": "Most blocked MFAs", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "sortBy": [ { "itemKey": "Count", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "Count", "sortOrder": 2 } ] }, "customWidth": "50", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog \n| where DeviceVendor has 'Silverfort'\n| where DeviceProduct has 'Admin Console'\n| extend Vendor = coalesce(replace('\\\"', '', DeviceVendor), \"n/a\")\n| extend Product = coalesce(replace('\\\"', '', DeviceProduct), \"n/a\")\n| extend ProductVersion = coalesce(replace('\\\"', '', DeviceVersion), \"n/a\")\n| extend Severity = coalesce(replace('\\\"', '', LogSeverity), \"n/a\")\n| extend SrcIpAddr = coalesce(replace('\\\"', '', SourceIP), \"n/a\")\n| extend SrcHostname = coalesce(replace('\\\"', '', SourceHostName), \"n/a\")\n| extend SrcUserName = coalesce(replace('\\\"', '', SourceUserName), \"n/a\")\n| extend Message = coalesce(replace('\\\"', '', Message), \"n/a\")\n| extend SubType = coalesce(replace('\\\"', '', DeviceEventClassID), \"n/a\")\n| extend Type = coalesce(replace('\\\"', '', Activity), \"n/a\")\n| extend DstUserName = coalesce(replace('\\\"', '', DestinationUserID), \"n/a\")\n| extend SilverfortReqRisk = coalesce(replace('\\\"', '', DeviceCustomString1), \"n/a\")\n| extend SilverfortReqResult = coalesce(replace('\\\"', '', DeviceCustomString2), \"n/a\")\n| extend SilverfortPolicyAction = coalesce(replace('\\\"', '', DeviceCustomString3), \"n/a\")\n| extend SilverfortPolicyId = coalesce(replace('\\\"', '', DeviceCustomString4), \"n/a\")\n| extend SilverfortMfaResponse = coalesce(replace('\\\"', '', DeviceCustomString5), \"n/a\")\n| extend SilverfortMfaResponseTime = coalesce(replace('\\\"', '', DeviceCustomString6), \"n/a\")\n| extend SilverfortRiskIndicators = coalesce(replace('\\\"', '', extract('cs7=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)), \"n/a\")\n| extend SilverfortPolicyName = coalesce(replace('\\\"', '', extract('cs8=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)), \"n/a\")\n| extend DstGeoCountry = coalesce(replace('\\\"', '', extract('cs9=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)), \"n/a\")\n| extend SilverfortCityOrigin = coalesce(replace('\\\"', '', extract('cs10=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)), \"n/a\")\n| extend SilverfortCoordinatesOrigin = coalesce(replace('\\\"', '', extract('cs11=\\\"([^\\\"]+)\\\"', 1, AdditionalExtensions)), \"n/a\")\n| extend DvcHostname = coalesce(replace('\\\"', '', DeviceAddress), \"n/a\")\n| where SilverfortMfaResponse has \"Timed Out\" \n| summarize Count = count() by SrcUserName\n| project SrcUserName, Count", "size": 0, "title": "Most Timed out MFAs", "timeContextFromParameter": "Timeframe", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "sortBy": [ { "itemKey": "Count", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "Count", "sortOrder": 2 } ] }, "customWidth": "50", "name": "query - 2" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "MFATab" }, "name": "group - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\n| where DeviceVendor has 'Silverfort'\n| where DeviceProduct has 'Admin Console'\n| extend ProductVersion = coalesce(replace('\\\"', '', DeviceVersion), \"n/a\")\n| extend SubType = coalesce(replace('\\\"', '', DeviceEventClassID), \"n/a\")\n| extend Name = toupper(substring(Message, 0, indexof(Message, \" count:\")))\n| extend Message = coalesce(replace('\\\"', '', Message), \"n/a\")\n| where SubType == \"DailyInsights\"\n| where Message matches regex \"count: \\\\d+\"\n| summarize arg_max(TimeGenerated, *) by Name, SubType\n| extend Count = toint(extract(@\"count:\\s*(\\d+)\", 1, Message))\n| extend Name = replace('\\\"', '', Name)\n| project Name, Count, TimeGenerated;", "size": 1, "title": "Inventory", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Name", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "rightContent": { "columnMatch": "DiffCountFormatted" }, "showBorder": true } }, "customWidth": "50", "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\n| where DeviceVendor has 'Silverfort' and DeviceProduct has 'Admin Console'\n| where Message !contains \"count:\"\n| extend SubType = coalesce(replace('\\\"', '', DeviceEventClassID), \"n/a\")\n| where SubType == \"DailyInsights\"\n| extend Name = replace('\\\"', '', toupper(substring(Message, 0, indexof(Message, \": \"))))\n| extend JsonData = extract(\"{.*}\", 0, Message)\n| extend JsonData = replace(\"}, {\", \"}~{\", tostring(JsonData))\n| extend JsonData = split(JsonData, \"~\")\n| mv-expand JsonData\n| project Name, JsonData\n| summarize Count = count() by Name\n", "size": 0, "title": "Users, Passwords, Servers and Devices", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Name", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "showBorder": true } }, "customWidth": "50", "name": "query - 9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog\n| where DeviceVendor has 'Silverfort'\n| where DeviceProduct has 'Admin Console'\n| where TimeGenerated >= ago(24h)\n| extend ProductVersion = coalesce(replace('\\\"', '', DeviceVersion), \"n/a\")\n| extend SubType = coalesce(replace('\\\"', '', DeviceEventClassID), \"n/a\")\n| extend Name = toupper(substring(Message, 0, indexof(Message, \": \")))\n| extend Message = coalesce(replace('\\\"', '', Message), \"n/a\")\n| where SubType == \"Authentication\"\n| summarize AuthCount = count() by bin(TimeGenerated, 1h)\n| project TimeGenerated, AuthCount\n| render barchart ", "size": 0, "title": "Daily Authentications (Per Hour)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "chartSettings": { "ySettings": { "label": "" } } }, "name": "query - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog \n| where DeviceVendor has 'Silverfort'\n| where DeviceProduct has 'Admin Console'\n| extend Vendor = coalesce(replace('\\\"', '', DeviceVendor), \"n/a\")\n| extend Product = coalesce(replace('\\\"', '', DeviceProduct), \"n/a\")\n| extend ProductVersion = coalesce(replace('\\\"', '', DeviceVersion), \"n/a\")\n| extend Severity = coalesce(replace('\\\"', '', LogSeverity), \"n/a\")\n| extend UserName = coalesce(replace('\\\"', '', SourceUserName), \"n/a\")\n| extend SubType = coalesce(replace('\\\"', '', DeviceEventClassID), \"n/a\")\n| extend Type = coalesce(replace('\\\"', '', Activity), \"n/a\")\n| extend Risk = coalesce(replace('\\\"', '', DeviceCustomString1), \"n/a\")\n| extend Risk = coalesce(replace('\\\"', '', DeviceCustomString1), \"n/a\")\n| extend DvcHostname = coalesce(replace('\\\"', '', DeviceAddress), \"n/a\")\n| where Risk in (\"Critical\", \"High\", \"Medium\", \"Low\")\n| where UserName matches regex @\"^[^@]+@[^@]+\\.[^@]+$\"\n| extend RiskOrder = case(\n Risk == \"Critical\", 1,\n Risk == \"High\", 2,\n Risk == \"Medium\", 3,\n Risk == \"Low\", 4,\n 5) // Default case, in case there are other values\n| extend EmailParts = split(UserName, \"@\")\n| extend UserName = tostring(EmailParts[0])\n| extend DomainName = tostring(EmailParts[1])\n| summarize arg_min(RiskOrder, *) by UserName\n| sort by RiskOrder asc, UserName\n| project UserName, Risk, DomainName\n\n\n", "size": 0, "title": "Top Risk Users (Last 24hrs)", "timeContext": { "durationMs": 604800000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "sortBy": [] }, "customWidth": "50", "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CommonSecurityLog \n| where DeviceVendor has 'Silverfort'\n| where DeviceProduct has 'Admin Console'\n| extend Vendor = coalesce(replace('\\\"', '', DeviceVendor), \"n/a\")\n| extend Product = coalesce(replace('\\\"', '', DeviceProduct), \"n/a\")\n| extend ProductVersion = coalesce(replace('\\\"', '', DeviceVersion), \"n/a\")\n| extend Severity = coalesce(replace('\\\"', '', LogSeverity), \"n/a\")\n| extend ResourceName = coalesce(replace('\\\"', '', SourceHostName), \"n/a\")\n| extend SrcUserName = coalesce(replace('\\\"', '', SourceUserName), \"n/a\")\n| extend Message = coalesce(replace('\\\"', '', Message), \"n/a\")\n| extend SubType = coalesce(replace('\\\"', '', DeviceEventClassID), \"n/a\")\n| extend Type = coalesce(replace('\\\"', '', Activity), \"n/a\")\n| extend Risk = coalesce(replace('\\\"', '', DeviceCustomString1), \"n/a\")\n| extend RiskOrder = case(\n Risk == \"Critical\", 1,\n Risk == \"High\", 2,\n Risk == \"Medium\", 3,\n Risk == \"Low\", 4,\n 5) // Default case, in case there are other values\n| where SrcUserName matches regex @\"^[^@]+@[^@]+\\.[^@]+$\"\n| extend EmailParts = split(SrcUserName, \"@\")\n| extend Username = tostring(EmailParts[0])\n| extend DomainName = tostring(EmailParts[1])\n| summarize arg_min(RiskOrder, *) by ResourceName\n| sort by RiskOrder asc, ResourceName asc\n| project ResourceName\n , Risk\n , DomainName\n", "size": 0, "title": "Top Risky Resources (Last 24hrs)", "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "query - 4" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "InsightsTab" }, "name": "group - 5" } ], "fallbackResourceIds": [], "fromTemplateId": "sentinel-silverfort-workbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }