Azure-Sentinel/Workbooks/IllusiveASM.json

{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## Illusive ASM Dashboard\n"
      },
      "name": "text - 2"
    },
    {
      "type": 1,
      "content": {
        "json": "\n"
      },
      "customWidth": "80",
      "name": "text - 2 - Copy"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "e5b79f84-7773-4162-9750-702cd0001041",
            "version": "KqlParameterItem/1.0",
            "name": "NumberOfDays",
            "label": "Number of Days ",
            "type": 2,
            "description": "Select range of days to query",
            "isRequired": true,
            "value": "14",
            "typeSettings": {
              "additionalResourceOptions": []
            },
            "jsonData": "[1,7,14,21,30]"
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "customWidth": "20",
      "name": "parameters - 6",
      "styleSettings": {
        "margin": "0px",
        "maxWidth": "50"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "union CommonSecurityLog | \r\nwhere (DeviceEventClassID == \"illusive:violation\") |\r\nwhere TimeGenerated > ago({NumberOfDays}d) |\r\nsummarize count = count() by ViolationType = DeviceCustomString1 \r\n\r\n",
        "size": 0,
        "title": "Violation Types",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "chartSettings": {
          "yAxis": [
            "count"
          ],
          "group": "ViolationType",
          "createOtherGroup": 7
        }
      },
      "customWidth": "50",
      "name": "Violation Types",
      "styleSettings": {
        "maxWidth": "50"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let binSize = iff({NumberOfDays} > 1, 1d, 1h);\nunion CommonSecurityLog | \nwhere (DeviceEventClassID == \"illusive:violation\") |\nwhere TimeGenerated > ago({NumberOfDays}d) | \nmake-series event_count=count() default=0 on TimeGenerated in range (ago({NumberOfDays}d), now(), binSize) |\nmvexpand TimeGenerated, event_count |\nproject todatetime(TimeGenerated), toint(event_count)",
        "size": 0,
        "aggregation": 3,
        "title": "Violations Over Time",
        "timeContext": {
          "durationMs": 2592000000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "linechart",
        "chartSettings": {
          "seriesLabelSettings": [
            {
              "seriesName": "event_count",
              "color": "yellow"
            }
          ]
        }
      },
      "customWidth": "50",
      "name": "Violations Trendline",
      "styleSettings": {
        "maxWidth": "50"
      }
    },
    {
      "type": 1,
      "content": {
        "json": "\r\n## Domain User Credentials"
      },
      "name": "text - 9"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "union CommonSecurityLog | \r\nwhere (DeviceEventClassID == \"illusive:violation\") |\r\nwhere (DeviceCustomString1 == \"USER_CREDENTIALS\") |\r\nwhere TimeGenerated > ago({NumberOfDays}d) |\r\nsummarize NumberOfViolations = count() by TopViolatingHost = SourceHostName |\r\ntop 5 by NumberOfViolations desc\r\n\r\n",
        "size": 0,
        "title": "Domain User Credentials - Top Violating Hosts",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "gridSettings": {
          "rowLimit": 10
        },
        "chartSettings": {
          "yAxis": [
            "NumberOfViolations"
          ],
          "group": "TopViolatingHost",
          "createOtherGroup": 6
        }
      },
      "customWidth": "50",
      "name": "Domain User Credentials Top Violating Hosts",
      "styleSettings": {
        "maxWidth": "50"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "union CommonSecurityLog | \r\nwhere (DeviceEventClassID == \"illusive:violation\") |\r\nwhere (DeviceCustomString1 == \"USER_CREDENTIALS\") |\r\nwhere TimeGenerated > ago({NumberOfDays}d) |\r\nsummarize NumberOfViolations = count() by TopViolatingUsers = SourceUserName |\r\ntop 5 by NumberOfViolations desc\r\n\r\n",
        "size": 0,
        "title": "Domain User Credentials - Top Violating Users",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "gridSettings": {
          "rowLimit": 10
        },
        "chartSettings": {
          "yAxis": [
            "NumberOfViolations"
          ],
          "group": "TopViolatingUsers",
          "createOtherGroup": 7
        }
      },
      "customWidth": "50",
      "name": "Domain User Credentials Top Violating Users",
      "styleSettings": {
        "maxWidth": "50"
      }
    },
    {
      "type": 1,
      "content": {
        "json": "\r\n## Crown Jewel Connections"
      },
      "name": "text - 9 - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "union CommonSecurityLog | \r\nwhere (DeviceEventClassID == \"illusive:violation\") |\r\nwhere (DeviceCustomString1 == \"CROWN_JEWEL_CREDENTIALS\") |\r\nwhere TimeGenerated > ago({NumberOfDays}d) |\r\nsummarize NumberOfViolations = count() by TopViolatingHost = SourceHostName |\r\ntop 5 by NumberOfViolations desc\r\n\r\n",
        "size": 0,
        "title": "Crown Jewel Connections - Top Violating Hosts",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "gridSettings": {
          "rowLimit": 10
        },
        "chartSettings": {
          "yAxis": [
            "NumberOfViolations"
          ],
          "group": "TopViolatingHost",
          "createOtherGroup": 6
        }
      },
      "customWidth": "33",
      "name": "Crown Jewel Connections Top Violating Hosts",
      "styleSettings": {
        "maxWidth": "33"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "union CommonSecurityLog | \r\nwhere (DeviceEventClassID == \"illusive:violation\") |\r\nwhere (DeviceCustomString1 == \"CROWN_JEWEL_CREDENTIALS\") |\r\nwhere TimeGenerated > ago({NumberOfDays}d) |\r\nsummarize NumberOfViolations = count() by CrownJewelType = DeviceCustomString6 |\r\ntop 5 by NumberOfViolations desc\r\n\r\n",
        "size": 0,
        "title": "Crown Jewel Connections - Crown Jewel Types",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "gridSettings": {
          "rowLimit": 10
        },
        "chartSettings": {
          "yAxis": [
            "NumberOfViolations"
          ],
          "group": "CrownJewelType",
          "createOtherGroup": 6
        }
      },
      "customWidth": "33",
      "name": "Crown Jewel Connections - Crown Jewel Types",
      "styleSettings": {
        "maxWidth": "33"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "union CommonSecurityLog | \r\nwhere (DeviceEventClassID == \"illusive:violation\") |\r\nwhere (DeviceCustomString1 == \"CROWN_JEWEL_CREDENTIALS\") |\r\nwhere TimeGenerated > ago({NumberOfDays}d) |\r\nsummarize NumberOfViolations = count() by ServiceType = DeviceCustomString4 |\r\ntop 5 by NumberOfViolations desc\r\n\r\n",
        "size": 0,
        "title": "Crown Jewel Connections - Service Types",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "gridSettings": {
          "rowLimit": 10
        },
        "chartSettings": {
          "yAxis": [
            "NumberOfViolations"
          ],
          "group": "ServiceType",
          "createOtherGroup": 8
        }
      },
      "customWidth": "33",
      "name": "Crown Jewel Connections - Service Types",
      "styleSettings": {
        "maxWidth": "33"
      }
    },
    {
      "type": 1,
      "content": {
        "json": "\r\n## Local User Administrators"
      },
      "name": "text - 9 - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "union CommonSecurityLog | \r\nwhere (DeviceEventClassID == \"illusive:violation\") |\r\nwhere (DeviceCustomString1 == \"LOCAL_USER_ADMINISTRATORS\") |\r\nwhere TimeGenerated > ago({NumberOfDays}d) |\r\nsummarize NumberOfViolations = count() by TopViolatingHost = SourceHostName |\r\ntop 5 by NumberOfViolations desc\r\n\r\n",
        "size": 0,
        "title": "Local User Administrators - Top Violating Hosts",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "chartSettings": {
          "yAxis": [
            "NumberOfViolations"
          ],
          "group": "TopViolatingHost",
          "createOtherGroup": 7
        }
      },
      "customWidth": "50",
      "name": "Local User Administrators Top Violating Hosts",
      "styleSettings": {
        "maxWidth": "50"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "union CommonSecurityLog | \r\nwhere (DeviceEventClassID == \"illusive:violation\") |\r\nwhere (DeviceCustomString1 == \"LOCAL_USER_ADMINISTRATORS\") |\r\nwhere TimeGenerated > ago({NumberOfDays}d) |\r\nsummarize NumberOfViolations = count() by TopViolatingUsers = SourceUserName |\r\ntop 5 by NumberOfViolations desc\r\n\r\n",
        "size": 0,
        "title": "Local User Administrators - Top Violating Users",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "chartSettings": {
          "yAxis": [
            "NumberOfViolations"
          ],
          "group": "TopViolatingUsers",
          "createOtherGroup": 7
        }
      },
      "customWidth": "50",
      "name": "Local User Administrators - Top Violating Users",
      "styleSettings": {
        "maxWidth": "50"
      }
    },
    {
      "type": 1,
      "content": {
        "json": "\r\n## Suspicious Files"
      },
      "name": "text - 9 - Copy - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "union CommonSecurityLog | \r\nwhere (DeviceEventClassID == \"illusive:violation\") |\r\nwhere (DeviceCustomString1 == \"SUSPICIOUS_FILES\") |\r\nwhere TimeGenerated > ago({NumberOfDays}d) |\r\nsummarize NumberOfViolations = count() by TopSuspiciousFilesHashes = DeviceCustomString3  |\r\ntop 5 by NumberOfViolations desc\r\n\r\n",
        "size": 0,
        "title": "Suspicious Files - Top Violating Processes",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "chartSettings": {
          "yAxis": [
            "NumberOfViolations"
          ],
          "group": "TopViolatingHost",
          "createOtherGroup": 7
        }
      },
      "customWidth": "50",
      "name": "Suspicious Files Top Violating Hosts",
      "styleSettings": {
        "maxWidth": "50"
      }
    }
  ],
  "styleSettings": {},
  "fromTemplateId": "sentinel-IllusiveASM",
   "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}