changes

Workbooks/AWSNetworkActivities.json

@@ -1,15 +0,0 @@
-{
-  "name": "{workbook_name}",
-  "location": "{workbook_location}",
-  "tags": null,
-  "type": "microsoft.insights/workbooks",
-  "kind": "shared",
-  "properties": {
-    "displayName": "{workbook_type} {workbook_resourceGroup}",
-    "version": "1.0",
-    "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":\"{\\\"json\\\":\\\"AWS network activities \\\"}\",\"name\":\"text - 1\"}],\"isLocked\":false}",
-    "category": "workbook",
-    "isPersisted": true,
-    "tags": [ "AmazonWebServicesNetworkActivitiesWorkbook", "1.0"]
-  }
-}

Workbooks/AWSUserActivities.json

@@ -1,15 +0,0 @@
-{
-  "name": "{workbook_name}",
-  "location": "{workbook_location}",
-  "tags": null,
-  "type": "microsoft.insights/workbooks",
-  "kind": "shared",
-  "properties": {
-    "displayName": "{workbook_type} {workbook_resourceGroup}",
-    "version": "1.0",
-    "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":\"{\\\"json\\\":\\\"AWS user activities \\\"}\",\"name\":\"text - 1\"}],\"isLocked\":false}",
-    "category": "workbook",
-    "isPersisted": true,
-    "tags": [ "AmazonWebServicesUserActivitiesWorkbook", "1.0" ]
-  }
-}

Workbooks/AzureFirewall.json

@@ -1,15 +0,0 @@
-{
-  "name": "{workbook_name}",
-  "location": "{workbook_location}",
-  "tags": null,
-  "type": "microsoft.insights/workbooks",
-  "kind": "shared",
-  "properties": {
-    "displayName": "{workbook_type} {workbook_resourceGroup}",
-    "version": "1.0",
-    "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":\"{\\\"json\\\":\\\"Events by time\\\"}\",\"name\":\"text - 7\"},{\"type\":3,\"content\":\"{\\\"version\\\":\\\"KqlItem/1.0\\\",\\\"query\\\":\\\"AzureDiagnostics \\\\r\\\\n| where ResourceType == \\\\\\\"AZUREFIREWALLS\\\\\\\" \\\\r\\\\n| summarize Volume=count() by TimeGenerated\\\\r\\\\n\\\",\\\"size\\\":0,\\\"queryType\\\":0,\\\"resourceType\\\":\\\"microsoft.operationalinsights/workspaces\\\",\\\"visualization\\\":\\\"linechart\\\"}\",\"name\":\"Events by time\"},{\"type\":1,\"content\":\"{\\\"json\\\":\\\"\\\"}\",\"name\":\"text - 1\"},{\"type\":3,\"content\":\"{\\\"version\\\":\\\"KqlItem/1.0\\\",\\\"query\\\":\\\"AzureDiagnostics \\\\r\\\\n| where ResourceType == \\\\\\\"AZUREFIREWALLS\\\\\\\" \\\\r\\\\n| summarize count() by Category, TimeGenerated\\\\r\\\\n\\\",\\\"size\\\":0,\\\"queryType\\\":0,\\\"resourceType\\\":\\\"microsoft.operationalinsights/workspaces\\\",\\\"visualization\\\":\\\"areachart\\\"}\",\"name\":\"query - 2\"},{\"type\":3,\"content\":\"{\\\"version\\\":\\\"KqlItem/1.0\\\",\\\"query\\\":\\\"AzureDiagnostics \\\\r\\\\n| where ResourceType == \\\\\\\"AZUREFIREWALLS\\\\\\\" \\\\r\\\\n| summarize count() by Category, TimeGenerated\\\\r\\\\n\\\",\\\"size\\\":0,\\\"queryType\\\":0,\\\"resourceType\\\":\\\"microsoft.operationalinsights/workspaces\\\",\\\"visualization\\\":\\\"piechart\\\"}\",\"name\":\"query - 3\"},{\"type\":3,\"content\":\"{\\\"version\\\":\\\"KqlItem/1.0\\\",\\\"query\\\":\\\"AzureDiagnostics \\\\r\\\\n| where Category == \\\\\\\"AzureFirewallNetworkRule\\\\\\\" \\\\r\\\\n| parse msg_s with Protocol \\\\\\\" request from \\\\\\\" SourceIP \\\\\\\":\\\\\\\" SourcePortInt:int \\\\\\\" to \\\\\\\" TargetIP \\\\\\\":\\\\\\\" TargetPortInt:int * \\\\r\\\\n| parse msg_s with * \\\\\\\". Action: \\\\\\\" Action1a \\\\r\\\\n| parse msg_s with * \\\\\\\"was \\\\\\\" Action1b \\\\\\\" to \\\\\\\" NatDestination \\\\r\\\\n| parse msg_s with Protocol2 \\\\\\\" request from \\\\\\\" SourceIP2 \\\\\\\" to \\\\\\\" TargetIP2 \\\\\\\". Action: \\\\\\\" Action2 \\\\r\\\\n| extend SourcePort = tostring(SourcePortInt),TargetPort = tostring(TargetPortInt) \\\\r\\\\n| extend Action = case(Action1a == \\\\\\\"\\\\\\\", \\\\r\\\\ncase(Action1b == \\\\\\\"\\\\\\\",Action2,Action1b), Action1a),Protocol = case(Protocol == \\\\\\\"\\\\\\\", \\\\r\\\\nProtocol2, Protocol),SourceIP = case(SourceIP == \\\\\\\"\\\\\\\", SourceIP2, SourceIP),\\\\r\\\\nTargetIP = case(TargetIP == \\\\\\\"\\\\\\\", TargetIP2, TargetIP),\\\\r\\\\nSourcePort = case(SourcePort == \\\\\\\"\\\\\\\", \\\\\\\"N/A\\\\\\\", SourcePort),\\\\r\\\\nTargetPort = case(TargetPort == \\\\\\\"\\\\\\\", \\\\\\\"N/A\\\\\\\", TargetPort), \\\\r\\\\nNatDestination = case(NatDestination == \\\\\\\"\\\\\\\", \\\\r\\\\n\\\\\\\"N/A\\\\\\\", NatDestination)  \\\\r\\\\n| summarize AMOUNT=count() by TargetPort, SourceIP\\\\r\\\\n\\\",\\\"size\\\":0,\\\"queryType\\\":0,\\\"resourceType\\\":\\\"microsoft.operationalinsights/workspaces\\\"}\",\"name\":\"query - 4\"},{\"type\":1,\"content\":\"{\\\"json\\\":\\\"*Rule actions*\\\"}\",\"name\":\"text - 5\"},{\"type\":3,\"content\":\"{\\\"version\\\":\\\"KqlItem/1.0\\\",\\\"query\\\":\\\"AzureDiagnostics \\\\r\\\\n| where Category == \\\\\\\"AzureFirewallNetworkRule\\\\\\\" \\\\r\\\\n| parse msg_s with Protocol \\\\\\\" request from \\\\\\\" SourceIP \\\\\\\":\\\\\\\" SourcePortInt:int \\\\\\\" to \\\\\\\" TargetIP \\\\\\\":\\\\\\\" TargetPortInt:int * \\\\r\\\\n| parse msg_s with * \\\\\\\". Action: \\\\\\\" Action1a \\\\r\\\\n| parse msg_s with * \\\\\\\"was \\\\\\\" Action1b \\\\\\\" to \\\\\\\" NatDestination\\\\r\\\\n| parse msg_s with Protocol2 \\\\\\\" request from \\\\\\\" SourceIP2 \\\\\\\" to \\\\\\\" TargetIP2 \\\\\\\". Action:\\\\\\\" Action2 \\\\r\\\\n| extend SourcePort = tostring(SourcePortInt),TargetPort = tostring(TargetPortInt) \\\\r\\\\n| extend Action = case(Action1a == \\\\\\\"\\\\\\\", \\\\r\\\\ncase(Action1b == \\\\\\\"\\\\\\\",Action2,Action1b), Action1a),\\\\r\\\\nProtocol = case(Protocol == \\\\\\\"\\\\\\\", Protocol2, Protocol),\\\\r\\\\nSourceIP = case(SourceIP == \\\\\\\"\\\\\\\", SourceIP2, SourceIP),\\\\r\\\\nTargetIP = case(TargetIP == \\\\\\\"\\\\\\\", TargetIP2, TargetIP),\\\\r\\\\nSourcePort = case(SourcePort == \\\\\\\"\\\\\\\", \\\\\\\"N/A\\\\\\\", SourcePort),\\\\r\\\\nTargetPort = case(TargetPort == \\\\\\\"\\\\\\\", \\\\\\\"N/A\\\\\\\", TargetPort),\\\\r\\\\nNatDestination = case(NatDestination == \\\\\\\"\\\\\\\", \\\\\\\"N/A\\\\\\\", NatDestination)  \\\\r\\\\n| summarize amount = count() by Action\\\\r\\\\n\\\",\\\"size\\\":0,\\\"queryType\\\":0,\\\"resourceType\\\":\\\"microsoft.operationalinsights/workspaces\\\",\\\"visualization\\\":\\\"piechart\\\"}\",\"name\":\"query - 6\"}],\"isLocked\":false,\"styleSettings\":{}}",
-    "category": "workbook",
-    "isPersisted": true,
-    "tags": [ "AzureFirewallWorkbook", "1.0" ]
-  }
-}

Workbooks/AzureInformationProtectionUsage.json

@@ -1,15 +0,0 @@
-{
-  "name": "{workbook_name}",
-  "location": "{workbook_location}",
-  "tags": null,
-  "type": "microsoft.insights/workbooks",
-  "kind": "shared",
-  "properties": {
-    "displayName": "{workbook_type} {workbook_resourceGroup}",
-    "version": "1.0",
-    "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":\"{\\\"json\\\":\\\"Azure information protection \\\"}\",\"name\":\"text - 1\"}],\"isLocked\":false}",
-    "category": "workbook",
-    "isPersisted": true,
-    "tags": [ "AzureInformationProtectionUsageReportWorkbook", "1.0" ]
-  }
-}

Workbooks/AzureNetworkWatcher.json

@@ -1,15 +0,0 @@
-{
-  "name": "{workbook_name}",
-  "location": "{workbook_location}",
-  "tags": null,
-  "type": "microsoft.insights/workbooks",
-  "kind": "shared",
-  "properties": {
-    "displayName": "{workbook_type} {workbook_resourceGroup}",
-    "version": "1.0",
-    "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":\"{\\\"json\\\":\\\"Azure network watcher \\\"}\",\"name\":\"text - 1\"}],\"isLocked\":false}",
-    "category": "workbook",
-    "isPersisted": true,
-    "tags": [ "AzureNetworkWatcherWorkbook", "1.0" ]
-  }
-}

Workbooks/AzureWebApplicationFirewall.json

@@ -1,15 +0,0 @@
-{
-  "name": "{workbook_name}",
-  "location": "{workbook_location}",
-  "tags": null,
-  "type": "microsoft.insights/workbooks",
-  "kind": "shared",
-  "properties": {
-    "displayName": "{workbook_type} {workbook_resourceGroup}",
-    "version": "1.0",
-    "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":\"{\\\"json\\\":\\\"WAF Workbook\\\"}\",\"name\":\"text - 1\"}],\"isLocked\":false}",
-    "category": "workbook",
-    "isPersisted": true,
-    "tags": [ "AzureWebApplicationFirewallWorkbook", "1.0" ]
-  }
-}

Workbooks/Azure_Active_Directory.json

@@ -1,15 +0,0 @@
-{
-  "name": "{workbook_name}",
-  "location": "{workbook_location}",
-  "tags": null,
-  "type": "microsoft.insights/workbooks",
-  "kind": "shared",
-  "properties": {
-    "displayName": "{workbook_type} {workbook_resourceGroup}",
-    "version": "1.0",
-    "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":\"{\\\"json\\\":\\\"Azure active directory \\\"}\",\"name\":\"text - 1\"}],\"isLocked\":false}",
-    "category": "workbook",
-    "isPersisted": true,
-    "tags": [ "AzureActiveDirectoryWorkbook" , "1.0"]
-  }
-}

Workbooks/CheckPointSoftwareTechnologies.json

@@ -1,15 +0,0 @@
-{
-  "name": "{workbook_name}",
-  "location": "{workbook_location}",
-  "tags": null,
-  "type": "microsoft.insights/workbooks",
-  "kind": "shared",
-  "properties": {
-    "displayName": "{workbook_type} {workbook_resourceGroup}",
-    "version": "1.0",
-    "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":\"{\\\"json\\\":\\\"Check point \\\"}\",\"name\":\"text - 1\"}],\"isLocked\":false}",
-    "category": "workbook",
-    "isPersisted": true,
-    "tags": [ "CheckPointSoftwareTechnologiesWorkbook" , "1.0"]
-  }
-}

Workbooks/CyberArk.json

@@ -1,15 +0,0 @@
-{
-  "name": "{workbook_name}",
-  "location": "{workbook_location}",
-  "tags": null,
-  "type": "microsoft.insights/workbooks",
-  "kind": "shared",
-  "properties": {
-    "displayName": "{workbook_type} {workbook_resourceGroup}",
-    "version": "1.0",
-    "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":\"{\\\"json\\\":\\\"cyber ark \\\"}\",\"name\":\"text - 1\"}],\"isLocked\":false}",
-    "category": "workbook",
-    "isPersisted": true,
-    "tags": [ "CyberArkWorkbook", "1.0" ]
-  }
-}

Workbooks/Cylance.json

@@ -1,15 +0,0 @@
-{
-  "name": "{workbook_name}",
-  "location": "{workbook_location}",
-  "tags": null,
-  "type": "microsoft.insights/workbooks",
-  "kind": "shared",
-  "properties": {
-    "displayName": "{workbook_type} {workbook_resourceGroup}",
-    "version": "1.2",
-    "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":\"{\\\"json\\\":\\\"cylance \\\"}\",\"name\":\"text - 1\"}],\"isLocked\":false}",
-    "category": "workbook",
-    "isPersisted": true,
-    "tags": [ "CylanceWorkbook" , "1.2"]
-  }
-}

Workbooks/Dns.json

@@ -1,15 +0,0 @@
-{
-  "name": "{workbook_name}",
-  "location": "{workbook_location}",
-  "tags": null,
-  "type": "microsoft.insights/workbooks",
-  "kind": "shared",
-  "properties": {
-    "displayName": "{workbook_type} {workbook_resourceGroup}",
-    "version": "1.0",
-    "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":\"{\\\"json\\\":\\\"Dns Workbook \\\"}\",\"name\":\"text - 1\"}],\"isLocked\":false}",
-    "category": "workbook",
-    "isPersisted": true,
-    "tags": ["DnsWorkbook", "1.0"]
-  }
-}

Workbooks/ExchangeOnline.json

@@ -1,15 +0,0 @@
-{
-  "name": "{workbook_name}",
-  "location": "{workbook_location}",
-  "tags": null,
-  "type": "microsoft.insights/workbooks",
-  "kind": "shared",
-  "properties": {
-    "displayName": "{workbook_type} {workbook_resourceGroup}",
-    "version": "1.0",
-    "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":\"{\\\"json\\\":\\\"Exchange online \\\"}\",\"name\":\"text - 1\"}],\"isLocked\":false}",
-    "category": "workbook",
-    "isPersisted": true,
-    "tags": [ "ExchangeOnlineWorkbook", "1.0"]
-  }
-}

Workbooks/F5Networks.json

@@ -1,15 +0,0 @@
-{
-  "name": "{workbook_name}",
-  "location": "{workbook_location}",
-  "tags": null,
-  "type": "microsoft.insights/workbooks",
-  "kind": "shared",
-  "properties": {
-    "displayName": "{workbook_type} {workbook_resourceGroup}",
-    "version": "1.0",
-    "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":\"{\\\"json\\\":\\\"F5 Workbook \\\"}\",\"name\":\"text - 1\"}],\"isLocked\":false}",
-    "category": "workbook",
-    "isPersisted": true,
-    "tags": [ "F5ASMWorkbook", "1.0" ]
-  }
-}

Workbooks/FortiGate.json

@@ -1,15 +0,0 @@
-{
-  "name": "{workbook_name}",
-  "location": "{workbook_location}",
-  "tags": null,
-  "type": "microsoft.insights/workbooks",
-  "kind": "shared",
-  "properties": {
-    "displayName": "{workbook_type} {workbook_resourceGroup}",
-    "version": "1.0",
-    "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":\"{\\\"json\\\":\\\"Fortigate \\\"}\",\"name\":\"text - 1\"}],\"isLocked\":false}",
-    "category": "workbook",
-    "isPersisted": true,
-    "tags": [ "FortiGateWorkbook", "1.0" ]
-  }
-}

Workbooks/IdentityAndAccess.json

@@ -1,15 +0,0 @@
-{
-  "name": "{workbook_name}",
-  "location": "{workbook_location}",
-  "tags": null,
-  "type": "microsoft.insights/workbooks",
-  "kind": "shared",
-  "properties": {
-    "displayName": "{workbook_type} {workbook_resourceGroup}",
-    "version": "1.0",
-    "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":\"{\\\"json\\\":\\\"Identity and access \\\"}\",\"name\":\"text - 1\"}],\"isLocked\":false}",
-    "category": "workbook",
-    "isPersisted": true,
-    "tags": [ "IdentityAndAccessWorkbook", "1.0" ]
-  }
-}