diff --git a/Solutions/Snowflake/Package/2.0.0.zip b/Solutions/Snowflake/Package/2.0.0.zip index ad0594d9e5..523013d6b1 100644 Binary files a/Solutions/Snowflake/Package/2.0.0.zip and b/Solutions/Snowflake/Package/2.0.0.zip differ diff --git a/Solutions/Snowflake/Package/mainTemplate.json b/Solutions/Snowflake/Package/mainTemplate.json index 9c75ffcfc6..1b9d433b6d 100644 --- a/Solutions/Snowflake/Package/mainTemplate.json +++ b/Solutions/Snowflake/Package/mainTemplate.json @@ -2700,7 +2700,7 @@ }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"**NOTE**: This data connector depends on a parser based on Kusto Function **Snowflake** to work as expected. [Follow steps to get this Kusto Function](https://aka.ms/sentinel-snowflake-parser)\"},\"name\":\"text - 8\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"cd8447d9-b096-4673-92d8-2a1e8291a125\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"description\":\"Sets the time name for analysis\",\"value\":{\"durationMs\":7776000000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":86400000},{\"durationMs\":604800000},{\"durationMs\":2592000000},{\"durationMs\":7776000000}]},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\r\\n| make-series TotalEvents = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain};\",\"size\":0,\"title\":\"Events Over Time\",\"color\":\"green\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"graphSettings\":{\"type\":0}},\"customWidth\":\"60\",\"name\":\"query - 12\",\"styleSettings\":{\"maxWidth\":\"55\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\n| where isnotempty(DATABASE_NAME_s)\\n| summarize dcount(DATABASE_NAME_s)\",\"size\":3,\"title\":\"Total Databases\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"50\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\n| where isnotempty(source_table_s)\\n| summarize dcount(source_table_s)\",\"size\":3,\"title\":\"Total Tables\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"50\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\n| summarize s=sum(EXECUTION_TIME_d)\\n| project s_time = strcat(s/1000, ' sec')\",\"size\":3,\"title\":\"Total Query Time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"30\",\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\n| where isnotempty(QUERY_TYPE_s)\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries Run\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"30\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\n| summarize cs = sum(CREDITS_USED_CLOUD_SERVICES_d)\\n| project round(cs, 8)\",\"size\":3,\"title\":\"Credits Spent\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"40\",\"name\":\"query - 4\"}]},\"customWidth\":\"40\",\"name\":\"group - 0\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\n| where isnotempty(source_table_s)\\n| summarize count() by source_table_s\",\"size\":3,\"title\":\"Table Events Summary\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"source_table_s\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"showBorder\":false}},\"customWidth\":\"50\",\"name\":\"query - 0\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\n| where isnotempty(DATABASE_NAME_s)\\n| summarize count() by DATABASE_NAME_s\",\"size\":3,\"title\":\"Database Events Summary\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"DATABASE_NAME_s\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false}},\"customWidth\":\"50\",\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}}]},\"customWidth\":\"30\",\"name\":\"group - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\n| where isnotempty(SrcDvcIpAddr)\\n| summarize count() by SrcDvcIpAddr\",\"size\":3,\"title\":\"Source Addresses\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"30\",\"name\":\"query - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\n| where EXECUTION_TIME_d > 0\\n| top 10 by EXECUTION_TIME_d desc\\n| project Query=QUERY_TEXT_s, User=TargetUsername, ExecutionTime=EXECUTION_TIME_d\\n\",\"size\":0,\"title\":\"Query Execution Time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ExecutionTime\",\"formatter\":8,\"formatOptions\":{\"palette\":\"coldHot\"}}]}},\"customWidth\":\"35\",\"name\":\"query - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\n| where CREDITS_USED_CLOUD_SERVICES_d > 0\\n| summarize by QUERY_TEXT_s, CREDITS_USED_CLOUD_SERVICES_d\\n| top 10 by CREDITS_USED_CLOUD_SERVICES_d desc\\n| project Query=QUERY_TEXT_s, CreditsSpent=CREDITS_USED_CLOUD_SERVICES_d\",\"size\":0,\"title\":\"Credits Spent by Queriws\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"CreditsSpent\",\"formatter\":8,\"formatOptions\":{\"palette\":\"coldHot\",\"compositeBarSettings\":{\"labelText\":\"\"}},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":10}}}]}},\"customWidth\":\"35\",\"name\":\"query - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\r\\n| where QUERY_TYPE_s == 'CREATE_USER'\\r\\n| extend n_usr = extract(@'USER\\\\s(\\\\S+)', 1, QUERY_TEXT_s)\\r\\n| project Username=n_usr\",\"size\":0,\"title\":\"New Users\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"URL Category\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"purple\"}},\"showBorder\":false},\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"20\",\"name\":\"query - 0\",\"styleSettings\":{\"maxWidth\":\"30\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\n\\n| where QUERY_TYPE_s =~ 'SELECT'\\n| summarize roles = makeset(ROLE_NAME_s) by TargetUsername\\n| join(Snowflake\\n | where EventType =~ 'LOGIN') on TargetUsername\\n| project EventTime=TimeGenerated, TargetUsername, SourceAddress=SrcDvcIpAddr, Status=strcat(iif(IS_SUCCESS_s =~ 'No', '❌ - Login Failure' , '✅ - Logged in'))\",\"size\":0,\"title\":\"Privileged Sessions\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"User\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TotalMailsReceived\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":10,\"formatOptions\":{\"palette\":\"magenta\"}},\"showBorder\":false}},\"customWidth\":\"45\",\"name\":\"query - 10\"}],\"fromTemplateId\":\"sentinel-SnowflakeWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"**NOTE**: This data connector depends on a parser based on Kusto Function **Snowflake** to work as expected. [Follow steps to get this Kusto Function](https://aka.ms/sentinel-SnowflakeDataConnector-parser)\"},\"name\":\"text - 8\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"cd8447d9-b096-4673-92d8-2a1e8291a125\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"description\":\"Sets the time name for analysis\",\"value\":{\"durationMs\":7776000000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":86400000},{\"durationMs\":604800000},{\"durationMs\":2592000000},{\"durationMs\":7776000000}]},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\r\\n| make-series TotalEvents = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain};\",\"size\":0,\"title\":\"Events Over Time\",\"color\":\"green\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"graphSettings\":{\"type\":0}},\"customWidth\":\"60\",\"name\":\"query - 12\",\"styleSettings\":{\"maxWidth\":\"55\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\n| where isnotempty(DATABASE_NAME_s)\\n| summarize dcount(DATABASE_NAME_s)\",\"size\":3,\"title\":\"Total Databases\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"50\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\n| where isnotempty(source_table_s)\\n| summarize dcount(source_table_s)\",\"size\":3,\"title\":\"Total Tables\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"50\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\n| summarize s=sum(EXECUTION_TIME_d)\\n| project s_time = strcat(s/1000, ' sec')\",\"size\":3,\"title\":\"Total Query Time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"30\",\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\n| where isnotempty(QUERY_TYPE_s)\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries Run\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"30\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\n| summarize cs = sum(CREDITS_USED_CLOUD_SERVICES_d)\\n| project round(cs, 8)\",\"size\":3,\"title\":\"Credits Spent\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"40\",\"name\":\"query - 4\"}]},\"customWidth\":\"40\",\"name\":\"group - 0\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\n| where isnotempty(source_table_s)\\n| summarize count() by source_table_s\",\"size\":3,\"title\":\"Table Events Summary\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"source_table_s\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"showBorder\":false}},\"customWidth\":\"50\",\"name\":\"query - 0\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\n| where isnotempty(DATABASE_NAME_s)\\n| summarize count() by DATABASE_NAME_s\",\"size\":3,\"title\":\"Database Events Summary\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"DATABASE_NAME_s\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false}},\"customWidth\":\"50\",\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}}]},\"customWidth\":\"30\",\"name\":\"group - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\n| where isnotempty(SrcDvcIpAddr)\\n| summarize count() by SrcDvcIpAddr\",\"size\":3,\"title\":\"Source Addresses\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"30\",\"name\":\"query - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\n| where EXECUTION_TIME_d > 0\\n| top 10 by EXECUTION_TIME_d desc\\n| project Query=QUERY_TEXT_s, User=TargetUsername, ExecutionTime=EXECUTION_TIME_d\\n\",\"size\":0,\"title\":\"Query Execution Time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ExecutionTime\",\"formatter\":8,\"formatOptions\":{\"palette\":\"coldHot\"}}]}},\"customWidth\":\"35\",\"name\":\"query - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\n| where CREDITS_USED_CLOUD_SERVICES_d > 0\\n| summarize by QUERY_TEXT_s, CREDITS_USED_CLOUD_SERVICES_d\\n| top 10 by CREDITS_USED_CLOUD_SERVICES_d desc\\n| project Query=QUERY_TEXT_s, CreditsSpent=CREDITS_USED_CLOUD_SERVICES_d\",\"size\":0,\"title\":\"Credits Spent by Queriws\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"CreditsSpent\",\"formatter\":8,\"formatOptions\":{\"palette\":\"coldHot\",\"compositeBarSettings\":{\"labelText\":\"\"}},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":10}}}]}},\"customWidth\":\"35\",\"name\":\"query - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\r\\n| where QUERY_TYPE_s == 'CREATE_USER'\\r\\n| extend n_usr = extract(@'USER\\\\s(\\\\S+)', 1, QUERY_TEXT_s)\\r\\n| project Username=n_usr\",\"size\":0,\"title\":\"New Users\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"URL Category\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"purple\"}},\"showBorder\":false},\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"20\",\"name\":\"query - 0\",\"styleSettings\":{\"maxWidth\":\"30\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Snowflake\\n\\n| where QUERY_TYPE_s =~ 'SELECT'\\n| summarize roles = makeset(ROLE_NAME_s) by TargetUsername\\n| join(Snowflake\\n | where EventType =~ 'LOGIN') on TargetUsername\\n| project EventTime=TimeGenerated, TargetUsername, SourceAddress=SrcDvcIpAddr, Status=strcat(iif(IS_SUCCESS_s =~ 'No', '❌ - Login Failure' , '✅ - Logged in'))\",\"size\":0,\"title\":\"Privileged Sessions\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"User\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TotalMailsReceived\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":10,\"formatOptions\":{\"palette\":\"magenta\"}},\"showBorder\":false}},\"customWidth\":\"45\",\"name\":\"query - 10\"}],\"fromTemplateId\":\"sentinel-SnowflakeWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" diff --git a/Solutions/Snowflake/Workbooks/Snowflake.json b/Solutions/Snowflake/Workbooks/Snowflake.json index 6f93200232..7fd2b7c8c7 100644 --- a/Solutions/Snowflake/Workbooks/Snowflake.json +++ b/Solutions/Snowflake/Workbooks/Snowflake.json @@ -4,7 +4,7 @@ { "type": 1, "content": { - "json": "**NOTE**: This data connector depends on a parser based on Kusto Function **Snowflake** to work as expected. [Follow steps to get this Kusto Function](https://aka.ms/sentinel-snowflake-parser)" + "json": "**NOTE**: This data connector depends on a parser based on Kusto Function **Snowflake** to work as expected. [Follow steps to get this Kusto Function](https://aka.ms/sentinel-SnowflakeDataConnector-parser)" }, "name": "text - 8" },