Azure
/
Azure-Sentinel
зеркало из
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность
Azure-Sentinel/Workbooks/SymantecVIP.json

408 строки
12 KiB
JSON
Исходник Обычный вид История

ACNCD_AzureSentinel-DataConnectors (#706) * SymantecProxySG Connector Upload * PulseSecureVPN Connector Upload * updated Kusto Function links * updated Yaml Syntax * add new line * add new line at end * add new line at end * add new line at end * add new line at end * error corrections * Syslog Revisions and 2 New Submissions * Pulseconnectsecure add. corrections * corrections * corrections * minor type correction * corrected dataconnector pages * update SymantecProxySG Rules * add logos to main dir
2020-06-06 00:14:23 +03:00
{
"version": "Notebook/1.0",
"items": [
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "1115aea6-5b33-4d1d-9f17-46452a39691f",
"version": "KqlParameterItem/1.0",
"name": "TimeRange",
"label": "Time Range",
"type": 4,
"value": {
"durationMs": 604800000
},
"typeSettings": {
"selectableValues": [
{
"durationMs": 300000
},
{
"durationMs": 900000
},
{
"durationMs": 1800000
},
{
"durationMs": 3600000
},
{
"durationMs": 14400000
},
{
"durationMs": 43200000
},
{
"durationMs": 86400000
},
{
"durationMs": 172800000
},
{
"durationMs": 259200000
},
{
"durationMs": 604800000
},
{
"durationMs": 1209600000
},
{
"durationMs": 2419200000
},
{
"durationMs": 2592000000
},
{
"durationMs": 5184000000
},
{
"durationMs": 7776000000
}
],
"allowCustom": true
},
"resourceType": "microsoft.insights/components"
},
{
"id": "7c8ba908-ba63-4e20-a4fd-d1cbf5555d4e",
"version": "KqlParameterItem/1.0",
"name": "VPNDevice",
"label": "VPN Device",
"type": 2,
"isRequired": true,
"multiSelect": true,
"quote": "'",
"delimiter": ",",
"query": "SymantecVIP\r\n| distinct Computer\r\n| sort by Computer asc",
"value": [
"value::all"
],
"typeSettings": {
"additionalResourceOptions": [
"value::all"
]
},
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
}
],
"style": "above",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - 3"
},
{
"type": 11,
"content": {
"version": "LinkItem/1.0",
"style": "tabs",
"links": [
{
"cellValue": "selectedTab",
"linkTarget": "parameter",
"linkLabel": "General",
"subTarget": "General",
"style": "link"
},
{
"cellValue": "selectedTab",
"linkTarget": "parameter",
"linkLabel": "User Analysis",
"subTarget": "UserAnalysis",
"style": "link"
}
]
},
"name": "links - 12"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SymantecVIP\r\n| where Computer in ({VPNDevice}) or '*' in ({VPNDevice})\r\n| summarize GRANTED = countif(AccessResult == \"GRANTED\"), DENIED = countif(AccessResult == \"DENIED\"), count() by bin(TimeGenerated, {TimeRange:grain})\r\n| project-away count_",
"size": 0,
"title": "User Access Events",
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "barchart",
"chartSettings": {
"seriesLabelSettings": [
{
"seriesName": "GRANTED",
"color": "green"
},
{
"seriesName": "DENIED",
"color": "red"
}
]
}
},
"conditionalVisibility": {
"parameterName": "selectedTab",
"comparison": "isEqualTo",
"value": "General"
},
"customWidth": "50",
"name": "query - 2"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SymantecVIP\r\n| where Computer in ({VPNDevice}) or '*' in ({VPNDevice})\r\n| summarize count() by Computer, bin(TimeGenerated, {TimeRange:grain})",
"size": 0,
"title": "Total VPN Device Events",
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "areachart",
"chartSettings": {
"seriesLabelSettings": [
{
"seriesName": "GRANTED",
"color": "green"
},
{
"seriesName": "DENIED",
"color": "red"
}
]
}
},
"conditionalVisibility": {
"parameterName": "selectedTab",
"comparison": "isEqualTo",
"value": "General"
},
"customWidth": "50",
"name": "query - 2 - Copy"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SymantecVIP\r\n| where Computer in ({VPNDevice}) or '*' in ({VPNDevice})\r\n| where AccessResult == \"DENIED\"\r\n| summarize count() by Reason",
"size": 0,
"title": "Top Denied Access Reasons",
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "piechart"
},
"conditionalVisibility": {
"parameterName": "selectedTab",
"comparison": "isEqualTo",
"value": "General"
},
"customWidth": "50",
"name": "query - 2"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SymantecVIP\r\n| where Computer in ({VPNDevice}) or '*' in ({VPNDevice})\r\n| where isnotempty(RADIUSAuth)\r\n| summarize Total = count() by User, Results = RADIUSAuth, Reason\r\n| sort by Total desc",
"size": 0,
"title": "Top 10 Users Rejected RADIUS Authentication",
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"gridSettings": {
"formatters": [
{
"columnMatch": "Total",
"formatter": 3,
"formatOptions": {
"palette": "coldHot"
}
}
]
}
},
"conditionalVisibility": {
"parameterName": "selectedTab",
"comparison": "isEqualTo",
"value": "General"
},
"customWidth": "50",
"name": "query - 2 - Copy"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SymantecVIP\r\n| where Computer in ({VPNDevice}) or '*' in ({VPNDevice})\r\n| where AccessResult == \"DENIED\"\r\n| summarize Total = count() by ClientIP\r\n| top 10 by Total\r\n",
"size": 0,
"title": "Top Denied Client IP Addresses",
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"conditionalVisibility": {
"parameterName": "selectedTab",
"comparison": "isEqualTo",
"value": "General"
},
"customWidth": "50",
"name": "query - 2 - Copy"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SymantecVIP\r\n| where Computer in ({VPNDevice}) or '*' in ({VPNDevice})\r\n| summarize count() by Component",
"size": 0,
"title": "Access Method",
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "piechart"
},
"conditionalVisibility": {
"parameterName": "selectedTab",
"comparison": "isEqualTo",
"value": "General"
},
"customWidth": "50",
"name": "query - 4"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"parameters": [
{
"id": "f764e22c-c942-4277-9b5d-7cd0c8b5a308",
"version": "KqlParameterItem/1.0",
"name": "UserList",
"label": "Select User(s)",
"type": 2,
"isRequired": true,
"multiSelect": true,
"quote": "'",
"delimiter": ",",
"query": "SymantecVIP \r\n| extend Username = iif(User has \"\\\\\", extract(@\"[a-zA-Z]+\\\\(\\S+)$\",1,User), User)\r\n| distinct tolower(Username)",
"value": [],
"typeSettings": {
"additionalResourceOptions": [
"value::all"
]
},
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
}
],
"style": "formVertical",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"conditionalVisibility": {
"parameterName": "selectedTab",
"comparison": "isEqualTo",
"value": "UserAnalysis"
},
"name": "parameters - 6"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SymantecVIP\r\n| extend Username = tolower(iif(User has \"\\\\\", extract(@\"[a-zA-Z]+\\\\(\\S+)$\",1,User), User))\r\n| where Username in ({UserList}) or '*' in ({UserList})\r\n| summarize count() by User, bin(TimeGenerated, {TimeRange:grain})",
"size": 1,
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "barchart"
},
"conditionalVisibility": {
"parameterName": "selectedTab",
"comparison": "isEqualTo",
"value": "UserAnalysis"
},
"name": "query - 10"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SymantecVIP\r\n| extend Username = tolower(iif(User has \"\\\\\", extract(@\"[a-zA-Z]+\\\\(\\S+)$\",1,User), User))\r\n| where Username in ({UserList}) or '*' in ({UserList})\r\n| project LogTime, User, Message\r\n| sort by LogTime, User asc",
"size": 0,
"title": "User Activity",
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"conditionalVisibility": {
"parameterName": "selectedTab",
"comparison": "isEqualTo",
"value": "UserAnalysis"
},
"customWidth": "50",
"name": "query - 5"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "SymantecVIP\r\n| extend Username = tolower(iif(User has \"\\\\\", extract(@\"[a-zA-Z]+\\\\(\\S+)$\",1,User), User))\r\n| where Username in ({UserList}) or '*' in ({UserList})\r\n| summarize count() by Component",
"size": 0,
"title": "User Access Method",
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"visualization": "piechart"
},
"conditionalVisibility": {
"parameterName": "selectedTab",
"comparison": "isEqualTo",
"value": "UserAnalysis"
},
"customWidth": "50",
"name": "query - 4 - Copy"
}
],
"fromTemplateId": "sentinel-UserWorkbook",
"$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}