Azure-Sentinel/Workbooks
liatlishams 48ae231c25
Merge pull request #1890 from Azure/link-kv-workbook-to-the-connector
assign workbook to kv connector
2021-03-09 09:32:05 +02:00
..
Images Move InfobloxCloud Solution Content 2021-03-08 13:31:29 -08:00
AIA-Darktrace.json updating workbook version 2021-02-15 17:10:17 +00:00
AIVectraDetectWorkbook.json
ASC-ComplianceandProtection.json Update ASC-ComplianceandProtection.json 2020-10-13 15:28:16 +03:00
AksSecurity.json Fix the coverage section of the AKS workbook 2020-12-14 12:25:50 +02:00
AlsidIoE.json More explanations about IoEs 2020-11-26 15:57:00 +01:00
AmazonWebServicesNetworkActivities.json
AmazonWebServicesUserActivities.json
AnalyticsEfficiency.json Merge pull request #1844 from Azure/Amitbergman-patch-16 2021-03-02 16:20:50 +02:00
AzDDoSStandardWorkbook.json Azure Firewall/DDoS Workbooks 2020-10-23 11:19:31 -04:00
AzureActiveDirectoryAuditLogs.json
AzureActiveDirectorySignins.json
AzureActivity.json Updated AzureActivity.json 2020-06-26 22:40:43 +05:30
AzureAuditActivityAndSignin.json
AzureFirewall.json
AzureFirewallWorkbook.json Update AzureFirewallWorkbook.json 2020-10-27 10:46:23 -04:00
AzureInformationProtection.json
AzureKeyVaultWorkbook.json Update KeyVault workbook 2021-02-02 14:11:14 +02:00
AzureNetworkWatcher.json
AzureSentinelSecurityAlerts.json Update AzureSentinelSecurityAlerts.json 2020-09-15 20:06:56 -07:00
BETTER_MTD_Workbook.json Added BETTER MTD sample workbook 2020-10-13 22:55:00 +04:00
Barracuda.json
CheckPoint.json
Cisco.json
CiscoUmbrella.json Workbooks: first commit 2020-11-27 16:06:22 +02:00
Citrix.json
CitrixWAF.json Rename Citrix WAF.json to CitrixWAF.json 2020-08-21 07:06:16 -07:00
CognniIncidentsWorkbook.json Removed unnecessary `union` from queries 2021-02-28 09:20:55 +02:00
CyberArkEPV.json Revert "Revert "CyberArk 31Jul"" (#975) 2020-08-14 15:20:38 -07:00
CyberpionOverviewWorkbook.json Update CyberpionOverviewWorkbook.json 2021-02-03 10:43:55 +02:00
CybersecurityMaturityModelCertification(CMMC).json Create CybersecurityMaturityModelCertification(CMMC).json 2021-01-28 08:23:13 +02:00
DataCollectionHealthMonitoring.json Update DataCollectionHealthMonitoring.json 2020-11-03 11:12:59 +02:00
Dns.json
EventAnalyzer.json
ExchangeOnline.json
ExtraHopDetectionSummary.json
F5BIGIPSystemMetrics.json
F5Networks.json
ForcepointCASB.json
ForcepointCloudSecuirtyGatewayworkbook.json Changes for ForcepointCloudSecurity 2021-01-20 13:15:01 +05:30
ForcepointDLP.json
ForcepointNGFW.json
Fortigate.json
GitHubSecurityWorkbook.json
IOT_Alerts.json Fix IoT workbook template bugs 2020-07-09 10:56:03 +03:00
IdentityAndAccess.json
IllusiveADS.json Illusive cef connector (#730) 2020-07-08 15:42:42 -07:00
IllusiveASM.json Illusive cef connector (#730) 2020-07-08 15:42:42 -07:00
IncidentOverview.json Update IncidentOverview.json 2021-02-28 13:31:46 +02:00
InfobloxNIOS.json ACN_CD_InfobloxUpdate (#879) 2020-07-24 11:54:35 -07:00
InsecureProtocols.json Update InsecureProtocols.json 2020-11-24 16:18:34 -05:00
IntsightsIOCWorkbook.json Add filters and update the screenshots 2021-01-18 12:32:09 +02:00
InvestigationInsights.json Add active colour and export to Excel 2020-12-11 15:15:31 +00:00
LinuxMachines.json
MITREAttack.json updated fields in query 2020-10-09 15:43:19 +00:00
MicrosoftCloudAppSecurity.json
NormalizedNetworkEvents.json Added normalized networking events workbook 2020-09-15 11:52:24 +03:00
Office365.json
OktaSingleSignOn.json ACNCD_DataConnectors_final (#767) 2020-07-07 15:25:53 -07:00
OnapsisAlarmsOverview.json Adding Onapsis Connector and Workbook (#1303) 2020-11-19 20:24:52 -08:00
OneIdentity.json
OrcaAlerts.json Orca security workbook (#938) 2020-11-25 14:12:03 -08:00
PaloAltoNetworkThreat.json Palo Alto data connector fixes (#1201) 2020-11-16 13:21:17 -08:00
PaloAltoOverview.json Palo Alto Overview Workbook fix (#1256) 2020-11-16 13:06:32 -08:00
Perimeter81OverviewWorkbook.json
ProofpointPOD.json Workbooks: first commit 2020-11-27 16:06:22 +02:00
ProofpointTAP.json ACNCD_Custom_DataConnector_v2 (#729) 2020-06-19 14:00:16 -07:00
PulseConnectSecure.json
QualysVM.json ACNCD_Custom_DataConnector_v2 (#729) 2020-06-19 14:00:16 -07:00
README.md
SecurityOperationsEfficiency.json Rename SecurityOperationsEfficiency to SecurityOperationsEfficiency.json 2021-02-16 15:05:17 +02:00
SecurityStatus.json Update SecurityStatus.json 2020-10-13 15:22:06 +03:00
SentinelCentral.json Initial release of a Workbook for MSSPs 2021-03-03 14:02:07 +00:00
SharePointAndOneDrive.json
SolarWindsPostCompromiseHunting.json Removed StS refresh sections 2021-01-20 12:28:24 -08:00
SophosXGFirewall.json ACNCD_DataConnectors_final (#767) 2020-07-07 15:25:53 -07:00
SquadraTechnologiesSecRMM.json
SymantecProxySG.json
SymantecVIP.json
SysmonThreatHunting.json fix master conflicts 2020-07-02 21:05:26 +02:00
ThreatIntelligence.json Adding new workbooks for version 2.2 2020-10-15 15:47:48 -07:00
ThycoticWorkbook.json Thycotic (#1372) 2020-12-01 23:54:39 -08:00
TrendMicroDeepSecurityAttackActivity.json
TrendMicroDeepSecurityOverview.json
TrendMicroXDROverview.json Trend Micro XDR Initial Commit (#1353) 2020-12-09 18:57:49 -08:00
UserEntityBehaviorAnalytics.json remove fallbackResourcesIds. + change Telemtry name fromTemplateId: UserAndEntityBehaviorAnalytics 2020-09-15 11:28:03 +03:00
UserMap.json Novermber Update. Add more search options for AAD users if 1000 or more have been found 2020-11-12 14:08:49 +00:00
VMwareCarbonBlack.json ACNCD_Custom_DataConnector_v2 (#729) 2020-06-19 14:00:16 -07:00
VirtualMachinesInsights.json
VisualizationDemo.json Update VisualizationDemo.json 2020-07-13 22:22:45 -04:00
WebApplicationFirewallFirewallEvents.json
WebApplicationFirewallGatewayAccessEvents.json remove resource 2020-07-30 18:28:35 +03:00
WebApplicationFirewallOverview.json
WebApplicationFirewallWAFTypeEvents.json Update WebApplicationFirewallWAFTypeEvents.json 2020-08-19 13:06:48 +03:00
WindowsFirewall.json
WorkbooksMetadata.json Merge pull request #1890 from Azure/link-kv-workbook-to-the-connector 2021-03-09 09:32:05 +02:00
WorkspaceAuditing.json Add files via upload 2020-09-28 17:33:38 +13:00
WorkspaceUsage.json Update WorkspaceUsage.json 2021-02-17 15:02:44 +00:00
ZimperiumWorkbooks.json
ZscalerFirewall.json
ZscalerOffice365Apps.json
ZscalerThreats.json
ZscalerWebOverview.json
esetSMCWorkbook.json adding Eset SMC parser (#476) 2020-07-08 17:55:11 -07:00

README.md

How to contribute new workbook

This assumes you already have a workbook that you want to share as an Azure Sentinel template.
Once this process is completed, Sentinel users will be able to save an instance of your template that will visualize the data in their own workspace.

To learn how to create workbooks - go to workbooks documentation.

  1. Go to your workbook -> edit mode -> advanced editor.

  2. Copy the gallery template.

  3. Add fromTemplateId to your template - this allows us to identify in our telemetry the specific sentinel workbook that was opened. Please be consistent with the format sentinel-"workbookName", for example (in the end of the gallery template):

     "styleSettings": {},
     "fromTemplateId": "sentinel-MyNewWorkbook",
     "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
    
    
  4. Capture 2 screenshots of your workbook - in dark and light theme (this will eventually be the preview images displayed in the workbooks blade).

Step 2 - Create a pull request to this repository

This pull request will contain:

  • The screenshots of your workbook. Place them under workbooks/images/preview.
    Please be consistent with the filename conventions - the dark theme filename should contain the word "black" and the light theme image should contain the word "white".

  • The gallery template json of your workbook. Place it directly under workbooks directory.

  • (optional) A logo that you want the workbook to display. Place it under workbooks/images/logos - if not supplied - it will be the generic workbooks logo.
    This logo should be in SVG format.

  • Change workbooksMetadata.json file, so that it will contain a new section, which will include:

    {
     "workbookKey": "YourWorkbookKey", // in the format of "<Name>Workbook" - not important what exactly is the name, just make sure it is unique and related to the workbook, for example PaloAltoOverviewWorkbook
    
     "logoFileName": "",//If you added logo - its name goes here
    
     "description": "description of the workbook.", // Will be displayed on the workbooks blade next to the logo and preview images
    
     "dataTypesDependencies": [ "Datatype" ],//The data type(s) that your workbook queries
    
     "dataConnectorsDependencies": [],//Relevant connectors
    
     "previewImagesFileNames": [ ],//The relative path of the preview images you saved under workbooks/images/previews
    
     "version": "1.0", // if this is a new workbook - this should be "1.0"
    
     "title": "Workbook title",//This should be the name of the workbook which will be displayed in the main workbooks blade - for example "Palo Alto overview"
    
     "templateRelativePath": "MyNewWorkbook.json",//The relative path of the JSON of the template (the gallery template you saved) 
    
     "subtitle": "",
    
     "provider": "Microsoft" //The provider of the workbook
     }
    
    

Here is an example of the JSON of Palo Alto workbook:

   {
  "workbookKey": "PaloAltoOverviewWorkbook",
  "logoFileName": "paloalto_logo.svg",
  "description": "Gain insights and comprehensive monitoring into Palo Alto firewalls by analyzing traffic and activities.\nThis workbook correlates all Palo Alto data with threat events to identify suspicious entities and relationships.\nYou can learn about trends across user and data traffic, and drill down into Palo Alto Wildfire and filter results.",
  "dataTypesDependencies": [ "CommonSecurityLog" ],
  "dataConnectorsDependencies": [ "PaloAlto" ],
  "previewImagesFileNames": [ "PaloAltoOverviewWhite1.png", "PaloAltoOverviewBlack1.png", "PaloAltoOverviewWhite2.png", "PaloAltoOverviewBlack2.png", "PaloAltoOverviewWhite3.png", "PaloAltoOverviewBlack3.png" ],
  "version": "1.1",
  "title": "Palo Alto overview",
  "templateRelativePath": "PaloAltoOverview.json",
  "subtitle": "",
  "provider": "Microsoft"
  },

After this PR is approved and completed, every 2 weeks the workbooks in Sentinel will be synced with the ones in github.

How to update an existing workbook

Just create a pull request to this repository in which you change the version of the relevant workbook in the WorkbooksMetadata.json file and change the relevant JSON of the workbook you would like to update. If needed, also update the preview images or the data types.

For any feedback on the instructions Open an issue