From 80d6166a8828f176c3c94815ee35e242cf947656 Mon Sep 17 00:00:00 2001 From: Samik Roy Date: Sun, 13 Sep 2020 10:21:38 +0530 Subject: [PATCH 1/9] Create ExternalUserAddedRemovedInTeams.yaml This detection flags the occurances of external user accounts that are added to a Team and then removed within one hour.This data is a part of Office 365 Connector in Azure Sentinel. More details: https://docs.microsoft.com/en-us/azure/sentinel/connect-office-365 --- .../ExternalUserAddedRemovedInTeams.yaml | 39 +++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 Detections/OfficeActivity/ExternalUserAddedRemovedInTeams.yaml diff --git a/Detections/OfficeActivity/ExternalUserAddedRemovedInTeams.yaml b/Detections/OfficeActivity/ExternalUserAddedRemovedInTeams.yaml new file mode 100644 index 00000000000..ff9a77bce65 --- /dev/null +++ b/Detections/OfficeActivity/ExternalUserAddedRemovedInTeams.yaml @@ -0,0 +1,39 @@ +id: e9cef368-6257-4dab-9a48-4793729c46a2 +name: External user added and removed in short timeframe +description: | + 'This detection flags the occurances of external user accounts that are added to a Team and then removed within + one hour.This data is a part of Office 365 Connector in Azure Sentinel. + More details: https://docs.microsoft.com/en-us/azure/sentinel/connect-office-365' +tactics: + - Persistence +relevantTechniques: + - T1136 +query: | + + // If you want to look at user added further than 7 days ago adjust this value + let time_ago = 7d; + // If you want to change the timeframe of how quickly accounts need to be added and removed change this value + // If you want to look at user added further than 7 days ago adjust this value + let time_ago = 7d; + // If you want to change the timeframe of how quickly accounts need to be added and removed change this value + let time_delta = 1h; + OfficeActivity + | where OfficeWorkload == "MicrosoftTeams" + | where TimeGenerated > ago(time_ago) + | where OfficeWorkload == "MicrosoftTeams" + | where TimeGenerated > ago(time_ago) + | where Operation =~ "MemberAdded" + | extend UPN = tostring(parse_json(Members)[0].UPN) + | where UPN contains ("#EXT#") + | project TimeAdded=TimeGenerated, Operation, UPN, UserWhoAdded = UserId, TeamName + | join ( + OfficeActivity + | where OfficeWorkload == "MicrosoftTeams" + | where TimeGenerated > ago(time_ago) + | where Operation =~ "MemberRemoved" + | extend UPN = tostring(parse_json(Members)[0].UPN) + | where UPN contains ("#EXT#") + | project TimeDeleted=TimeGenerated, Operation, UPN, UserWhoDeleted = UserId, TeamName, TeamGuid = tostring(Details.TeamGuid)) on UPN, TeamGuid + | where TimeDeleted < (TimeAdded + time_delta) + | project TimeAdded, TimeDeleted, UPN, UserWhoAdded, UserWhoDeleted, TeamName, TeamGuid + | extend timestamp = TimeAdded, AccountCustomEntity = UPN From 7a9540aa79c5225b578d6c3f8e79685441ca4518 Mon Sep 17 00:00:00 2001 From: Samik Roy Date: Sun, 13 Sep 2020 11:40:40 +0530 Subject: [PATCH 2/9] Update ExternalUserAddedRemovedInTeams.yaml --- .../ExternalUserAddedRemovedInTeams.yaml | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/Detections/OfficeActivity/ExternalUserAddedRemovedInTeams.yaml b/Detections/OfficeActivity/ExternalUserAddedRemovedInTeams.yaml index ff9a77bce65..d6a7a7ea3dd 100644 --- a/Detections/OfficeActivity/ExternalUserAddedRemovedInTeams.yaml +++ b/Detections/OfficeActivity/ExternalUserAddedRemovedInTeams.yaml @@ -1,4 +1,4 @@ -id: e9cef368-6257-4dab-9a48-4793729c46a2 +id: e9ceg568-6257-4dab-9a48-4793727y46a2 name: External user added and removed in short timeframe description: | 'This detection flags the occurances of external user accounts that are added to a Team and then removed within @@ -12,9 +12,6 @@ query: | // If you want to look at user added further than 7 days ago adjust this value let time_ago = 7d; - // If you want to change the timeframe of how quickly accounts need to be added and removed change this value - // If you want to look at user added further than 7 days ago adjust this value - let time_ago = 7d; // If you want to change the timeframe of how quickly accounts need to be added and removed change this value let time_delta = 1h; OfficeActivity @@ -25,7 +22,7 @@ query: | | where Operation =~ "MemberAdded" | extend UPN = tostring(parse_json(Members)[0].UPN) | where UPN contains ("#EXT#") - | project TimeAdded=TimeGenerated, Operation, UPN, UserWhoAdded = UserId, TeamName + | project TimeAdded=TimeGenerated, Operation, UPN, UserWhoAdded = UserId, TeamName=ItemName | join ( OfficeActivity | where OfficeWorkload == "MicrosoftTeams" @@ -33,7 +30,8 @@ query: | | where Operation =~ "MemberRemoved" | extend UPN = tostring(parse_json(Members)[0].UPN) | where UPN contains ("#EXT#") - | project TimeDeleted=TimeGenerated, Operation, UPN, UserWhoDeleted = UserId, TeamName, TeamGuid = tostring(Details.TeamGuid)) on UPN, TeamGuid + | project TimeDeleted=TimeGenerated, Operation, UPN, UserWhoDeleted = UserId, TeamName=ItemName + ) on UPN | where TimeDeleted < (TimeAdded + time_delta) - | project TimeAdded, TimeDeleted, UPN, UserWhoAdded, UserWhoDeleted, TeamName, TeamGuid + | project TimeAdded, TimeDeleted, UPN, UserWhoAdded, UserWhoDeleted, TeamName | extend timestamp = TimeAdded, AccountCustomEntity = UPN From a688667b71029fb132199cd03382765653330166 Mon Sep 17 00:00:00 2001 From: Samik Roy Date: Sun, 13 Sep 2020 11:42:39 +0530 Subject: [PATCH 3/9] Update ExternalUserAddedRemovedInTeams.yaml --- Detections/OfficeActivity/ExternalUserAddedRemovedInTeams.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/Detections/OfficeActivity/ExternalUserAddedRemovedInTeams.yaml b/Detections/OfficeActivity/ExternalUserAddedRemovedInTeams.yaml index d6a7a7ea3dd..85de9d2c923 100644 --- a/Detections/OfficeActivity/ExternalUserAddedRemovedInTeams.yaml +++ b/Detections/OfficeActivity/ExternalUserAddedRemovedInTeams.yaml @@ -2,8 +2,7 @@ id: e9ceg568-6257-4dab-9a48-4793727y46a2 name: External user added and removed in short timeframe description: | 'This detection flags the occurances of external user accounts that are added to a Team and then removed within - one hour.This data is a part of Office 365 Connector in Azure Sentinel. - More details: https://docs.microsoft.com/en-us/azure/sentinel/connect-office-365' + one hour.This data is a part of Office 365 Connector in Azure Sentinel.More details: https://docs.microsoft.com/en-us/azure/sentinel/connect-office-365' tactics: - Persistence relevantTechniques: From 21441d44818154f21b2ffca4e20959e9ccea0896 Mon Sep 17 00:00:00 2001 From: Samik Roy Date: Sun, 13 Sep 2020 11:52:59 +0530 Subject: [PATCH 4/9] Update ExternalUserAddedRemovedInTeams.yaml --- Detections/OfficeActivity/ExternalUserAddedRemovedInTeams.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Detections/OfficeActivity/ExternalUserAddedRemovedInTeams.yaml b/Detections/OfficeActivity/ExternalUserAddedRemovedInTeams.yaml index 85de9d2c923..c7193e5e8a3 100644 --- a/Detections/OfficeActivity/ExternalUserAddedRemovedInTeams.yaml +++ b/Detections/OfficeActivity/ExternalUserAddedRemovedInTeams.yaml @@ -2,7 +2,7 @@ id: e9ceg568-6257-4dab-9a48-4793727y46a2 name: External user added and removed in short timeframe description: | 'This detection flags the occurances of external user accounts that are added to a Team and then removed within - one hour.This data is a part of Office 365 Connector in Azure Sentinel.More details: https://docs.microsoft.com/en-us/azure/sentinel/connect-office-365' + one hour.This data is a part of Office 365 Connector in Azure Sentinel.' tactics: - Persistence relevantTechniques: From fb676349a5490fa8f7b2ad04ebf4695742a6064a Mon Sep 17 00:00:00 2001 From: Samik Roy Date: Sun, 13 Sep 2020 11:58:33 +0530 Subject: [PATCH 5/9] Delete AzureActivity.json --- Workbooks/AzureActivity.json | 331 ----------------------------------- 1 file changed, 331 deletions(-) delete mode 100644 Workbooks/AzureActivity.json diff --git a/Workbooks/AzureActivity.json b/Workbooks/AzureActivity.json deleted file mode 100644 index 3f7d2c44c68..00000000000 --- a/Workbooks/AzureActivity.json +++ /dev/null @@ -1,331 +0,0 @@ -{ - "version": "Notebook/1.0", - "items": [ - { - "type": 9, - "content": { - "version": "KqlParameterItem/1.0", - "query": "", - "crossComponentResources": [], - "parameters": [ - { - "id": "52bfbd84-1639-480c-bda5-bfc87fd81832", - "version": "KqlParameterItem/1.0", - "name": "TimeRange", - "type": 4, - "isRequired": true, - "value": { - "durationMs": 604800000 - }, - "typeSettings": { - "selectableValues": [ - { - "durationMs": 300000 - }, - { - "durationMs": 900000 - }, - { - "durationMs": 1800000 - }, - { - "durationMs": 3600000 - }, - { - "durationMs": 14400000 - }, - { - "durationMs": 43200000 - }, - { - "durationMs": 86400000 - }, - { - "durationMs": 172800000 - }, - { - "durationMs": 259200000 - }, - { - "durationMs": 604800000 - }, - { - "durationMs": 1209600000 - }, - { - "durationMs": 2419200000 - }, - { - "durationMs": 2592000000 - }, - { - "durationMs": 5184000000 - }, - { - "durationMs": 7776000000 - } - ] - } - }, - { - "id": "eeb5dcf9-e898-46af-9c12-d91d97e13cd3", - "version": "KqlParameterItem/1.0", - "name": "Caller", - "type": 2, - "isRequired": true, - "multiSelect": true, - "quote": "'", - "delimiter": ",", - "query": "AzureActivity\r\n| summarize by Caller", - "value": [ - "value::all" - ], - "typeSettings": { - "additionalResourceOptions": [ - "value::all" - ], - "selectAllValue": "All" - }, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" - }, - { - "id": "46375a76-7ae1-4d7e-9082-4191531198a9", - "version": "KqlParameterItem/1.0", - "name": "ResourceGroup", - "type": 2, - "isRequired": true, - "multiSelect": true, - "quote": "'", - "delimiter": ",", - "query": "AzureActivity\r\n| summarize by ResourceGroup", - "value": [ - "value::all" - ], - "typeSettings": { - "resourceTypeFilter": { - "microsoft.resources/resourcegroups": true - }, - "additionalResourceOptions": [ - "value::all" - ], - "selectAllValue": "All" - }, - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" - } - ], - "style": "pills", - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" - }, - "name": "parameters - 2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let data = AzureActivity\r\n| where \"{Caller:lable}\" == \"All\" or \"{Caller:lable}\" == \"All\" or Caller in ({Caller})\r\n| where \"{ResourceGroup:lable}\" == \"All\" or \"{ResourceGroup:lable}\" == \"All\" or ResourceGroup in ({ResourceGroup});\r\ndata\r\n| summarize Count = count() by ResourceGroup\r\n| join kind = fullouter (datatable(ResourceGroup:string)['Medium', 'high', 'low']) on ResourceGroup\r\n| project ResourceGroup = iff(ResourceGroup == '', ResourceGroup1, ResourceGroup), Count = iff(ResourceGroup == '', 0, Count)\r\n| join kind = inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ResourceGroup)\r\n on ResourceGroup\r\n| project-away ResourceGroup1, TimeGenerated\r\n| extend ResourceGroups = ResourceGroup\r\n| union (\r\n data \r\n | summarize Count = count() \r\n | extend jkey = 1\r\n | join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n | extend jkey = 1) on jkey\r\n | extend ResourceGroup = 'All', ResourceGroups = '*' \r\n)\r\n| order by Count desc\r\n| take 10", - "size": 4, - "exportToExcelOptions": "visible", - "title": "Top 10 active resource groups", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "visualization": "tiles", - "tileSettings": { - "titleContent": { - "columnMatch": "ResourceGroup", - "formatter": 1, - "formatOptions": { - "showIcon": true - } - }, - "leftContent": { - "columnMatch": "Count", - "formatter": 12, - "formatOptions": { - "palette": "auto", - "showIcon": true - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - }, - "secondaryContent": { - "columnMatch": "Trend", - "formatter": 9, - "formatOptions": { - "palette": "blueOrange", - "showIcon": true - } - }, - "showBorder": false - } - }, - "name": "query - 3" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureActivity\r\n| where \"{Caller:lable}\" == \"All\" or Caller in ({Caller})\r\n| where \"{ResourceGroup:lable}\" == \"All\" or ResourceGroup in ({ResourceGroup})\r\n| summarize deletions = countif(OperationName contains \"Delete\"), creations = countif(OperationName contains \"Create\"), updates = countif(OperationName contains \"Update\"), Activities = count(OperationName) by bin_at(TimeGenerated, 1h, now())\r\n", - "size": 0, - "exportToExcelOptions": "visible", - "title": "Activities over time", - "color": "gray", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "visualization": "linechart", - "graphSettings": { - "type": 0 - } - }, - "name": "query - 1" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureActivity\r\n| where \"{Caller:lable}\" == \"All\" or Caller in ({Caller})\r\n| where \"{ResourceGroup:lable}\" == \"All\" or ResourceGroup in ({ResourceGroup})\r\n| summarize deletions = countif(OperationName contains \"Delete\"), creations = countif(OperationName contains \"Create\"), updates = countif(OperationName contains \"Update\"), Activities = count() by Caller\r\n", - "size": 1, - "exportToExcelOptions": "visible", - "title": "Caller activities", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "gridSettings": { - "formatters": [ - { - "columnMatch": "Caller", - "formatter": 0, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "deletions", - "formatter": 4, - "formatOptions": { - "showIcon": true, - "aggregation": "Count" - } - }, - { - "columnMatch": "creations", - "formatter": 4, - "formatOptions": { - "palette": "purple", - "showIcon": true, - "aggregation": "Count" - } - }, - { - "columnMatch": "updates", - "formatter": 4, - "formatOptions": { - "palette": "gray", - "showIcon": true, - "aggregation": "Count" - } - }, - { - "columnMatch": "Activities", - "formatter": 4, - "formatOptions": { - "palette": "greenDark", - "linkTarget": "GenericDetails", - "linkIsContextBlade": true, - "showIcon": true, - "aggregation": "Count", - "workbookContext": { - "componentIdSource": "workbook", - "resourceIdsSource": "workbook", - "templateIdSource": "static", - "templateId": "https://go.microsoft.com/fwlink/?linkid=874159&resourceId=%2Fsubscriptions%2F44e4eff8-1fcb-4a22-a7d6-992ac7286382%2FresourceGroups%2FSOC&featureName=Workbooks&itemId=%2Fsubscriptions%2F44e4eff8-1fcb-4a22-a7d6-992ac7286382%2Fresourcegroups%2Fsoc%2Fproviders%2Fmicrosoft.insights%2Fworkbooks%2F4c195aec-747f-40bb-addb-934acb3ec646&name=CiscoASA&func=NavigateToPortalFeature&type=workbook", - "typeSource": "workbook", - "gallerySource": "workbook" - } - } - } - ], - "sortBy": [ - { - "itemKey": "$gen_bar_updates_3", - "sortOrder": 2 - } - ], - "labelSettings": [] - } - }, - "name": "query - 1" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureActivity \r\n| where \"{Caller:lable}\" == \"All\" or Caller in ({Caller})\r\n| where \"{ResourceGroup:lable}\" == \"All\" or ResourceGroup in ({ResourceGroup})\r\n| summarize Informational = countif(Level == \"Informational\"), Warning = countif(Level == \"Warning\"), Error = countif(Level == \"Error\") by bin_at(TimeGenerated, 1h, now())\r\n", - "size": 0, - "exportToExcelOptions": "visible", - "color": "redBright", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "visualization": "scatterchart", - "tileSettings": { - "showBorder": false - }, - "graphSettings": { - "type": 2, - "topContent": { - "columnMatch": "Error", - "formatter": 12, - "formatOptions": { - "showIcon": true - } - }, - "hivesContent": { - "columnMatch": "TimeGenerated", - "formatter": 1, - "formatOptions": { - "showIcon": true - } - }, - "nodeIdField": "Error", - "sourceIdField": "Error", - "targetIdField": "Error", - "nodeSize": null, - "staticNodeSize": 100, - "colorSettings": null, - "groupByField": "TimeGenerated", - "hivesMargin": 5 - } - }, - "name": "query - 4" - } - ], - "styleSettings": {}, - "fromTemplateId": "sentinel-AzureActivity", - "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" -} From 3cff8939cf2a34eaa2c2841ad4463d41d758263b Mon Sep 17 00:00:00 2001 From: Samik Roy Date: Sun, 13 Sep 2020 11:58:51 +0530 Subject: [PATCH 6/9] Delete WorkbooksMetadata.json --- Workbooks/WorkbooksMetadata.json | 935 ------------------------------- 1 file changed, 935 deletions(-) delete mode 100644 Workbooks/WorkbooksMetadata.json diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json deleted file mode 100644 index 3237c2c2aa3..00000000000 --- a/Workbooks/WorkbooksMetadata.json +++ /dev/null @@ -1,935 +0,0 @@ -[ - { - "workbookKey": "AzureActivityWorkbook", - "logoFileName": "azureactivity_logo.svg", - "description": "Gain extensive insight into your organization's Azure Activity by analyzing, and correlating all user operations and events.\nYou can learn about all user operations, trends, and anomalous changes over time.\nThis workbook gives you the ability to drill down into caller activities and summarize detected failure and warning events.", - "dataTypesDependencies": [ "AzureActivity" ], - "dataConnectorsDependencies": [ "AzureActivity" ], - "previewImagesFileNames": [ "AzureActivityWhite1.png", "AzureActivityBlack1.png" ], - "version": "1.3", - "title": "Azure Activity", - "templateRelativePath": "AzureActivity.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "IdentityAndAccessWorkbook", - "logoFileName": "Microsoft_logo.svg", - "description": "Gain insights into Identity and access operations by collecting and analyzing security logs, using the audit and sign-in logs to gather insights into use of Microsoft products.\nYou can view anomalies and trends across login events from all users and machines. This workbook also identifies suspicious entities from login and access events.", - "dataTypesDependencies": [ "SecurityEvent" ], - "dataConnectorsDependencies": [ "SecurityEvents" ], - "previewImagesFileNames": [ "IdentityAndAccessWhite.png", "IdentityAndAccessBlack.png" ], - "version": "1.1", - "title": "Identity & Access", - "templateRelativePath": "IdentityAndAccess.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "CheckPointWorkbook", - "logoFileName": "", - "description": "Gain insights into Check Point network activities, including number of gateways and servers, security incidents, and identify infected hosts.", - "dataTypesDependencies": [ "CommonSecurityLog" ], - "dataConnectorsDependencies": [ "CheckPoint" ], - "previewImagesFileNames": [ "CheckPointWhite.png", "CheckPointBlack.png" ], - "version": "1.0", - "title": "Check Point Software Technologies", - "templateRelativePath": "CheckPoint.json", - "subtitle": "", - "provider": "Check Point" - }, - { - "workbookKey": "CiscoWorkbook", - "logoFileName": "cisco_logo.svg", - "description": "Gain insights into your Cisco ASA firewalls by analyzing traffic, events, and firewall operations.\nThis workbook analyzes Cisco ASA threat events and identifies suspicious ports, users, protocols and IP addresses.\nYou can learn about trends across user and data traffic directions, and drill down into the Cisco filter results.\nEasily detect attacks on your organization by monitoring management operations, such as configuration and logins.", - "dataTypesDependencies": [ "CommonSecurityLog" ], - "dataConnectorsDependencies": [ "CiscoASA" ], - "previewImagesFileNames": [ "CiscoWhite.png", "CiscoBlack.png" ], - "version": "1.1", - "title": "Cisco - ASA", - "templateRelativePath": "Cisco.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "ExchangeOnlineWorkbook", - "logoFileName": "office365_logo.svg", - "description": "Gain insights into Microsoft Exchange online by tracing and analyzing all Exchange operations and user activities.\nThis workbook let you monitor user activities, including logins, account operations, permission changes, and mailbox creations to discover suspicious trends among them.", - "dataTypesDependencies": [ "OfficeActivity" ], - "dataConnectorsDependencies": [ "Office365" ], - "previewImagesFileNames": [ "ExchangeOnlineWhite.png", "ExchangeOnlineBlack.png" ], - "version": "1.1", - "title": "Exchange Online", - "templateRelativePath": "ExchangeOnline.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "PaloAltoOverviewWorkbook", - "logoFileName": "paloalto_logo.svg", - "description": "Gain insights and comprehensive monitoring into Palo Alto firewalls by analyzing traffic and activities.\nThis workbook correlates all Palo Alto data with threat events to identify suspicious entities and relationships.\nYou can learn about trends across user and data traffic, and drill down into Palo Alto Wildfire and filter results.", - "dataTypesDependencies": [ "CommonSecurityLog" ], - "dataConnectorsDependencies": [ "PaloAltoNetworks" ], - "previewImagesFileNames": [ "PaloAltoOverviewWhite1.png", "PaloAltoOverviewBlack1.png", "PaloAltoOverviewWhite2.png", "PaloAltoOverviewBlack2.png", "PaloAltoOverviewWhite3.png", "PaloAltoOverviewBlack3.png" ], - "version": "1.1", - "title": "Palo Alto overview", - "templateRelativePath": "PaloAltoOverview.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "PaloAltoNetworkThreatWorkbook", - "logoFileName": "paloalto_logo.svg", - "description": "Gain insights into Palo Alto network activities by analyzing threat events.\nYou can extract meaningful security information by correlating data between threats, applications, and time.\nThis workbook makes it easy to track malware, vulnerability, and virus log events.", - "dataTypesDependencies": [ "CommonSecurityLog" ], - "dataConnectorsDependencies": [ "PaloAltoNetworks" ], - "previewImagesFileNames": [ "PaloAltoNetworkThreatWhite1.png", "PaloAltoNetworkThreatBlack1.png", "PaloAltoNetworkThreatWhite2.png", "PaloAltoNetworkThreatBlack2.png" ], - "version": "1.0", - "title": "Palo Alto Network Threat", - "templateRelativePath": "PaloAltoNetworkThreat.json", - "subtitle": "", - "provider": "Palo Alto Networks" - }, - { - "workbookKey": "EsetSMCWorkbook", - "logoFileName": "eset-logo.svg", - "description": "Visualize events and threats from Eset Security Management Center.", - "dataTypesDependencies": [ "eset_CL" ], - "dataConnectorsDependencies": [ "EsetSMC" ], - "previewImagesFileNames": [ "esetSMCWorkbook-black.png", "esetSMCWorkbook-white.png" ], - "version": "1.0", - "title": "Eset Security Management Center Overview", - "templateRelativePath": "esetSMCWorkbook.json", - "subtitle": "", - "provider": "Community", - "featureFlag": "EsetSMCConnector" - }, - { - "workbookKey": "FortigateWorkbook", - "logoFileName": "fortinet_logo.svg", - "description": "Gain insights into Fortigate firewalls by analyzing traffic and activities.\nThis workbook finds correlations in Fortigate threat events and identifies suspicious ports, users, protocols and IP addresses.\nYou can learn about trends across user and data traffic, and drill down into the Fortigate filter results.\nEasily detect attacks on your organization by monitoring management operations such as configuration and logins.", - "dataTypesDependencies": [ "CommonSecurityLog" ], - "dataConnectorsDependencies": [ "Fortinet" ], - "previewImagesFileNames": [ "FortigateWhite.png", "FortigateBlack.png" ], - "version": "1.1", - "title": "FortiGate", - "templateRelativePath": "Fortigate.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "DnsWorkbook", - "logoFileName": "dns_logo.svg", - "description": "Gain extensive insight into your organization's DNS by analyzing, collecting and correlating all DNS events.\nThis workbook exposes a variety of information about suspicious queries, malicious IP addresses and domain operations.", - "dataTypesDependencies": [ "DnsInventory", "DnsEvents" ], - "dataConnectorsDependencies": [ "DNS" ], - "previewImagesFileNames": [ "DnsWhite.png", "DnsBlack.png" ], - "version": "1.2", - "title": "DNS", - "templateRelativePath": "Dns.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "Office365Workbook", - "logoFileName": "office365_logo.svg", - "description": "Gain insights into Office 365 by tracing and analyzing all operations and activities. You can drill down into your SharePoint, OneDrive, and Exchange.\nThis workbook lets you find usage trends across users, files, folders, and mailboxes, making it easier to identify anomalies in your network.", - "dataTypesDependencies": [ "OfficeActivity" ], - "dataConnectorsDependencies": [ "Office365" ], - "previewImagesFileNames": [ "Office365White1.png", "Office365Black1.png", "Office365White2.png", "Office365Black2.png", "Office365White3.png", "Office365Black3.png" ], - "version": "1.2", - "title": "Office 365", - "templateRelativePath": "Office365.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "SharePointAndOneDriveWorkbook", - "logoFileName": "office365_logo.svg", - "description": "Gain insights into SharePoint and OneDrive by tracing and analyzing all operations and activities.\nYou can view trends across user operation, find correlations between users and files, and identify interesting information such as user IP addresses.", - "dataTypesDependencies": [ "OfficeActivity" ], - "dataConnectorsDependencies": [ "Office365" ], - "previewImagesFileNames": [ "SharePointAndOneDriveBlack1.png", "SharePointAndOneDriveBlack2.png", "SharePointAndOneDriveWhite1.png", "SharePointAndOneDriveWhite2.png" ], - "version": "1.1", - "title": "SharePoint & OneDrive", - "templateRelativePath": "SharePointAndOneDrive.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "AzureActiveDirectorySigninLogsWorkbook", - "logoFileName": "azureactivedirectory_logo.svg", - "description": "Gain insights into Azure Active Directory by connecting Azure Sentinel and using the sign-in logs to gather insights around Azure AD scenarios. \nYou can learn about sign-in operations, such as user sign-ins and locations, email addresses, and IP addresses of your users, as well as failed activities and the errors that triggered the failures.", - "dataTypesDependencies": [ "SigninLogs" ], - "dataConnectorsDependencies": [ "AzureActiveDirectory" ], - "previewImagesFileNames": [ "AADsigninBlack1.png", "AADsigninBlack2.png", "AADsigninWhite1.png", "AADsigninWhite2.png" ], - "version": "1.0", - "title": "Azure AD Sign-in logs", - "templateRelativePath": "AzureActiveDirectorySignins.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "VirtualMachinesInsightsWorkbook", - "logoFileName": "azurevirtualmachine_logo.svg", - "description": "Gain rich insight into your organization's virtual machines from Azure Monitor, which analyzes and correlates data in your VM network. \nYou will get visibility on your VM parameters and behavior, and will be able to trace sent and received data. \nIdentify malicious attackers and their targets, and drill down into the protocols, source and destination IP addresses, countries, and ports the attacks occur across.", - "dataTypesDependencies": [ "VMConnection", "ServiceMapComputer_CL", "ServiceMapProcess_CL" ], - "dataConnectorsDependencies": [], - "previewImagesFileNames": [ "VMInsightBlack1.png", "VMInsightWhite1.png" ], - "version": "1.3", - "title": "VM insights", - "templateRelativePath": "VirtualMachinesInsights.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "AzureActiveDirectoryAuditLogsWorkbook", - "logoFileName": "azureactivedirectory_logo.svg", - "description": "Gain insights into Azure Active Directory by connecting Azure Sentinel and using the audit logs to gather insights around Azure AD scenarios. \nYou can learn about user operations, including password and group management, device activities, and top active users and apps.", - "dataTypesDependencies": [ "AuditLogs" ], - "dataConnectorsDependencies": [ "AzureActiveDirectory" ], - "previewImagesFileNames": [ "AzureADAuditLogsBlack1.png", "AzureADAuditLogsWhite1.png" ], - "version": "1.1", - "title": "Azure AD Audit logs", - "templateRelativePath": "AzureActiveDirectoryAuditLogs.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "ThreatIntelligenceWorkbook", - "logoFileName": "", - "description": "Gain insights into threat indicators, including type and severity of threats, threat activity over time, and correlation with other data sources, including Office 365 and firewalls.", - "dataTypesDependencies": [ "ThreatIntelligenceIndicator", "SecurityAlert" ], - "dataConnectorsDependencies": [ "ThreatIntelligence", "ThreatIntelligenceTaxii" ], - "previewImagesFileNames": [ "ThreatIntelligenceWhite.png", "ThreatIntelligenceBlack.png" ], - "version": "2.0", - "title": "Threat Intelligence", - "templateRelativePath": "ThreatIntelligence.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "WebApplicationFirewallOverviewWorkbook", - "logoFileName": "webapplicationfirewall(WAF)_logo.svg", - "description": "Gain insights into your organization's Azure web application firewall (WAF). You will get a general overview of your application gateway firewall and application gateway access events.", - "dataTypesDependencies": [ "AzureDiagnostics" ], - "dataConnectorsDependencies": [ "WAF" ], - "previewImagesFileNames": [ "WAFOverviewBlack.png", "WAFOverviewWhite.png" ], - "version": "1.1", - "title": "Microsoft Web Application Firewall (WAF) - overview", - "templateRelativePath": "WebApplicationFirewallOverview.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "WebApplicationFirewallFirewallEventsWorkbook", - "logoFileName": "webapplicationfirewall(WAF)_logo.svg", - "description": "Gain insights into your organization's Azure web application firewall (WAF). You will get visibility in to your application gateway firewall. You can view anomalies and trends across all firewall event triggers, attack events, blocked URL addresses and more.", - "dataTypesDependencies": [ "AzureDiagnostics" ], - "dataConnectorsDependencies": [ "WAF" ], - "previewImagesFileNames": [ "WAFFirewallEventsBlack1.png", "WAFFirewallEventsBlack2.png", "WAFFirewallEventsWhite1.png", "WAFFirewallEventsWhite2.png" ], - "version": "1.1", - "title": "Microsoft Web Application Firewall (WAF) - firewall events", - "templateRelativePath": "WebApplicationFirewallFirewallEvents.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "WebApplicationFirewallGatewayAccessEventsWorkbook", - "logoFileName": "webapplicationfirewall(WAF)_logo.svg", - "description": "Gain insights into your organization's Azure web application firewall (WAF). You will get visibility in to your application gateway access events. You can view anomalies and trends across received and sent data, client IP addresses, URL addresses and more, and drill down into details.", - "dataTypesDependencies": [ "AzureDiagnostics" ], - "dataConnectorsDependencies": [ "WAF" ], - "previewImagesFileNames": [ "WAFGatewayAccessEventsBlack1.png", "WAFGatewayAccessEventsBlack2.png", "WAFGatewayAccessEventsWhite1.png", "WAFGatewayAccessEventsWhite2.png" ], - "version": "1.2", - "title": "Microsoft Web Application Firewall (WAF) - gateway access events", - "templateRelativePath": "WebApplicationFirewallGatewayAccessEvents.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "LinuxMachinesWorkbook", - "logoFileName": "azurevirtualmachine_logo.svg", - "description": "Gain insights into your workspaces' Linux machines by connecting Azure Sentinel and using the logs to gather insights around Linux events and errors.", - "dataTypesDependencies": [ "Syslog" ], - "dataConnectorsDependencies": [ "Syslog" ], - "previewImagesFileNames": [ "LinuxMachinesWhite.png", "LinuxMachinesBlack.png" ], - "version": "1.1", - "title": "Linux machines", - "templateRelativePath": "LinuxMachines.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "AzureFirewallWorkbook", - "logoFileName": "", - "description": "Gain insights into Azure Firewall events. You can learn about your application and network rules, see statistics for firewall activities across URLs, ports, and addresses.", - "dataTypesDependencies": [ "AzureDiagnostics" ], - "dataConnectorsDependencies": ["AzureFirewall"], - "previewImagesFileNames": [ "AzureFirewallWhite1.png", "AzureFirewallBlack1.png", "AzureFirewallWhite2.png", "AzureFirewallBlack2.png", "AzureFirewallWhite3.png", "AzureFirewallBlack3.png" ], - "version": "1.0", - "title": "Azure Firewall", - "templateRelativePath": "AzureFirewall.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "MicrosoftCloudAppSecurityWorkbook", - "logoFileName": "Microsoft_logo.svg", - "description": "Using this workbook, you can identify which cloud apps are being used in your organization, gain insights from usage trends and drill down to a specific user and application", - "dataTypesDependencies": [ "McasShadowItReporting" ], - "dataConnectorsDependencies": [ "MicrosoftCloudAppSecurity" ], - "previewImagesFileNames": [ "McasDiscoveryBlack.png", "McasDiscoveryWhite.png" ], - "version": "1.2", - "title": "Microsoft Cloud App Security - discovery logs", - "templateRelativePath": "MicrosoftCloudAppSecurity.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "F5BIGIPSytemMetricsWorkbook", - "logoFileName": "f5_logo.svg", - "description": "Gain insight into F5 BIG-IP health and performance. This workbook provides visibility of various metrics including CPU, memory, connectivity, throughput and disk utilization.", - "dataTypesDependencies": [ "F5Telemetry_system_CL", "F5Telemetry_AVR_CL" ], - "dataConnectorsDependencies": [ "F5BigIp" ], - "previewImagesFileNames": [ "F5SMBlack.png", "F5SMWhite.png" ], - "version": "1.1", - "title": "F5 BIG-IP System Metrics", - "templateRelativePath": "F5BIGIPSystemMetrics.json", - "subtitle": "", - "provider": "F5 Networks" - }, - { - "workbookKey": "F5NetworksWorkbook", - "logoFileName": "f5_logo.svg", - "description": "Gain insights into F5 BIG-IP Application Security Manager (ASM), by analyzing traffic and activities.\nThis workbook provides insight into F5's web application firewall events and identifies attack traffic patterns across multiple ASM instances as well as overall BIG-IP health.", - "dataTypesDependencies": [ "F5Telemetry_LTM_CL", "F5Telemetry_system_CL", "F5Telemetry_ASM_CL" ], - "dataConnectorsDependencies": [ "F5BigIp" ], - "previewImagesFileNames": [ "F5White.png", "F5Black.png" ], - "version": "1.1", - "title": "F5 BIG-IP ASM", - "templateRelativePath": "F5Networks.json", - "subtitle": "", - "provider": "F5 Networks" - }, - { - "workbookKey": "AzureNetworkWatcherWorkbook", - "logoFileName": "networkwatcher_logo.svg", - "description": "Gain deeper understanding of your organization's Azure network traffic by analyzing, and correlating Network Security Group flow logs. \nYou can trace malicious traffic flows, and drill down into their protocols, source and destination IP addresses, machines, countries, and subnets. \nThis workbook also helps you protect your network by identifying weak NSG rules.", - "dataTypesDependencies": [ "AzureNetworkAnalytics_CL" ], - "dataConnectorsDependencies": [], - "previewImagesFileNames": [ "AzureNetworkWatcherWhite.png", "AzureNetworkWatcherBlack.png" ], - "version": "1.1", - "title": "Azure Network Watcher", - "templateRelativePath": "AzureNetworkWatcher.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "ZscalerFirewallWorkbook", - "logoFileName": "zscaler_logo.svg", - "description": "Gain insights into your ZIA cloud firewall logs by connecting to Azure Sentinel.\nThe Zscaler firewall overview workbook provides an overview and ability to drill down into all cloud firewall activity in your Zscaler instance including non-web related networking events, security events, firewall rules, and bandwidth consumption", - "dataTypesDependencies": [ "CommonSecurityLog" ], - "dataConnectorsDependencies": [ "Zscaler" ], - "previewImagesFileNames": [ "ZscalerFirewallWhite1.png", "ZscalerFirewallBlack1.png", "ZscalerFirewallWhite2.png", "ZscalerFirewallBlack2.png" ], - "version": "1.1", - "title": "Zscaler Firewall", - "templateRelativePath": "ZscalerFirewall.json", - "subtitle": "", - "provider": "Zscaler" - }, - { - "workbookKey": "ZscalerWebOverviewWorkbook", - "logoFileName": "zscaler_logo.svg", - "description": "Gain insights into your ZIA web logs by connecting to Azure Sentinel.\nThe Zscaler web overview workbook provides a bird's eye view and ability to drill down into all the security and networking events related to web transactions, types of devices, and bandwidth consumption.", - "dataTypesDependencies": [ "CommonSecurityLog" ], - "dataConnectorsDependencies": [ "Zscaler" ], - "previewImagesFileNames": [ "ZscalerWebOverviewWhite.png", "ZscalerWebOverviewBlack.png" ], - "version": "1.1", - "title": "Zscaler Web Overview", - "templateRelativePath": "ZscalerWebOverview.json", - "subtitle": "", - "provider": "Zscaler" - }, - { - "workbookKey": "ZscalerThreatsOverviewWorkbook", - "logoFileName": "zscaler_logo.svg", - "description": "Gain insights into threats blocked by Zscaler Internet access on your network.\nThe Zscaler threat overview workbook shows your entire threat landscape including blocked malware, IPS/AV rules, and blocked cloud apps. Threats are displayed by threat categories, filetypes, inbound vs outbound threats, usernames, user location, and more.", - "dataTypesDependencies": [ "CommonSecurityLog" ], - "dataConnectorsDependencies": [ "Zscaler" ], - "previewImagesFileNames": [ "ZscalerThreatsWhite.png", "ZscalerThreatsBlack.png" ], - "version": "1.2", - "title": "Zscaler Threats", - "templateRelativePath": "ZscalerThreats.json", - "subtitle": "", - "provider": "Zscaler" - }, - { - "workbookKey": "ZscalerOffice365AppsWorkbook", - "logoFileName": "zscaler_logo.svg", - "description": "Gain insights into Office 365 use on your network.\nThe Zscaler Office 365 overview workbook shows you the Microsoft apps running on your network and their individual bandwidth consumption. It also helps identify phishing attempts in which attackers disguised themselves as Microsoft services.", - "dataTypesDependencies": [ "CommonSecurityLog" ], - "dataConnectorsDependencies": [ "Zscaler" ], - "previewImagesFileNames": [ "ZscalerOffice365White.png", "ZscalerOffice365Black.png" ], - "version": "1.1", - "title": "Zscaler Office365 Apps", - "templateRelativePath": "ZscalerOffice365Apps.json", - "subtitle": "", - "provider": "Zscaler" - }, - { - "workbookKey": "InsecureProtocolsWorkbook", - "logoFileName": "Microsoft_logo.svg", - "description": "Gain insights into insecure protocol traffic by collecting and analyzing security events from Microsoft products.\nYou can view analytics and quickly identify use of weak authentication as well as sources of legacy protocol traffic, like NTLM and SMBv1.\nYou will also have the ability to monitor use of weak ciphers, allowing you to find weak spots in your organization's security.", - "dataTypesDependencies": [ "SecurityEvent", "Event", "SigninLogs" ], - "dataConnectorsDependencies": [ "SecurityEvents", "AzureActiveDirectory" ], - "previewImagesFileNames": [ "InsecureProtocolsWhite1.png", "InsecureProtocolsBlack1.png", "InsecureProtocolsWhite2.png", "InsecureProtocolsBlack2.png" ], - "version": "1.4", - "title": "Insecure Protocols", - "templateRelativePath": "InsecureProtocols.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "AzureInformationProtectionWorkbook", - "logoFileName": "informationProtection.svg", - "description": "The Azure Information Protection Usage report workbook provides information on the volume of labeled and protected documents and emails over time, label distribution of files by label type, along with where the label was applied.", - "dataTypesDependencies": [ "InformationProtectionLogs_CL" ], - "dataConnectorsDependencies": [ "AzureInformationProtection" ], - "previewImagesFileNames": [ "AzureInformationProtectionWhite.png", "AzureInformationProtectionBlack.png" ], - "version": "1.1", - "title": "Azure Information Protecton - Usage Report", - "templateRelativePath": "AzureInformationProtection.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "AmazonWebServicesNetworkActivitiesWorkbook", - "logoFileName": "amazon_web_services_Logo.svg", - "description": "Gain insights into AWS network related resource activities, including the creation, update, and deletions of security groups, network ACLs and routes, gateways, elastic load balancers, VPCs, subnets, and network interfaces.", - "dataTypesDependencies": [ "AWSCloudTrail" ], - "dataConnectorsDependencies": [ "AWS" ], - "previewImagesFileNames": [ "AwsNetworkActivitiesWhite.png", "AwsNetworkActivitiesBlack.png" ], - "version": "1.0", - "title": "AWS Network Activities", - "templateRelativePath": "AmazonWebServicesNetworkActivities.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "AmazonWebServicesUserActivitiesWorkbook", - "logoFileName": "amazon_web_services_Logo.svg", - "description": "Gain insights into AWS user activities, including failed sign-in attempts, IP addresses, regions, user agents, and identity types, as well as potential malicious user activities with assumed roles.", - "dataTypesDependencies": [ "AWSCloudTrail" ], - "dataConnectorsDependencies": [ "AWS" ], - "previewImagesFileNames": [ "AwsUserActivitiesWhite.png", "AwsUserActivitiesBlack.png" ], - "version": "1.0", - "title": "AWS User Activities", - "templateRelativePath": "AmazonWebServicesUserActivities.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "TrendMicroDeepSecurityAttackActivityWorkbook", - "logoFileName": "trendmicro_logo.svg", - "description": "Visualize and gain insights into the MITRE ATT&CK related activity detected by Trend Micro Deep Security.", - "dataTypesDependencies": [ "CommonSecurityLog" ], - "dataConnectorsDependencies": [ "TrendMicro" ], - "previewImagesFileNames": [ "TrendMicroDeepSecurityAttackActivityWhite.png", "TrendMicroDeepSecurityAttackActivityBlack.png" ], - "version": "1.0", - "title": "Trend Micro Deep Security", - "templateRelativePath": "TrendMicroDeepSecurityAttackActivity.json", - "subtitle": "", - "provider": "Trend Micro" - }, - { - "workbookKey": "TrendMicroDeepSecurityOverviewWorkbook", - "logoFileName": "trendmicro_logo.svg", - "description": "Gain insights into your Trend Micro Deep Security security event data by visualizing your Deep Security Anti-Malware, Firewall, Integrity Monitoring, Intrusion Prevention, Log Inspection, and Web Reputation event data.", - "dataTypesDependencies": [ "CommonSecurityLog" ], - "dataConnectorsDependencies": [ "TrendMicro" ], - "previewImagesFileNames": [ "TrendMicroDeepSecurityOverviewWhite1.png", "TrendMicroDeepSecurityOverviewBlack1.png", "TrendMicroDeepSecurityOverviewWhite2.png", "TrendMicroDeepSecurityOverviewBlack2.png" ], - "version": "1.0", - "title": "Trend Micro", - "templateRelativePath": "TrendMicroDeepSecurityOverview.json", - "subtitle": "", - "provider": "Trend Micro" - }, - { - "workbookKey": "ExtraHopDetectionSummaryWorkbook", - "logoFileName": "extrahop_logo.svg", - "description": "Gain insights into ExtraHop Reveal(x) detections by analyzing traffic and activities.\nThis workbook provides an overview of security detections in your organization's network, including high-risk detections and top participants.", - "dataTypesDependencies": [ "CommonSecurityLog" ], - "dataConnectorsDependencies": [ "ExtraHopNetworks" ], - "previewImagesFileNames": [ "ExtrahopWhite.png", "ExtrahopBlack.png" ], - "version": "1.0", - "title": "ExtraHop", - "templateRelativePath": "ExtraHopDetectionSummary.json", - "subtitle": "", - "provider": "ExtraHop Networks" - }, - { - "workbookKey": "BarracudaCloudFirewallWorkbook", - "logoFileName": "barracuda_logo.svg", - "description": "Gain insights into your Barracuda CloudGen Firewall by analyzing firewall operations and events.\nThis workbook provides insights into rule enforcement, network activities, including number of connections, top users, and helps you identify applications that are popular on your network.", - "dataTypesDependencies": [ "CommonSecurityLog", "Syslog" ], - "dataConnectorsDependencies": [ "BarracudaCloudFirewall" ], - "previewImagesFileNames": [ "BarracudaWhite1.png", "BarracudaBlack1.png", "BarracudaWhite2.png", "BarracudaBlack2.png" ], - "version": "1.0", - "title": "Barracuda CloudGen FW", - "templateRelativePath": "Barracuda.json", - "subtitle": "", - "provider": "Barracuda" - }, - { - "workbookKey": "CitrixWorkbook", - "logoFileName": "citrix_logo.svg", - "description": "Citrix Analytics Workbook is one that visualizes the user behavior analysis performed by Citrix Analytics.\nAn admin can troubleshoot and monitor user activities in an enterprise.", - "dataTypesDependencies": [ "CitrixAnalytics_SAlerts_CL", "CitrixAnalytics_SActions_CL", "CitrixAnalytics_SWatchList_CL" ], - "dataConnectorsDependencies": [ "Citrix" ], - "previewImagesFileNames": [ "CitrixWhite.png", "CitrixBlack.png" ], - "version": "2.0", - "title": "Citrix", - "templateRelativePath": "Citrix.json", - "subtitle": "", - "provider": "Citrix Systems Inc." - }, - { - "workbookKey": "OneIdentityWorkbook", - "logoFileName": "oneIdentity_logo.svg", - "description": "This simple workbook gives an overview of sessions going through your SafeGuard for Privileged Sessions device.", - "dataTypesDependencies": [ "CommonSecurityLog" ], - "dataConnectorsDependencies": [ "OneIdentity" ], - "previewImagesFileNames": [ "OneIdentityWhite.png", "OneIdentityBlack.png" ], - "version": "1.0", - "title": "One Identity", - "templateRelativePath": "OneIdentity.json", - "subtitle": "", - "provider": "One Identity LLC." - }, - { - "workbookKey": "SecurityStatusWorkbook", - "logoFileName": "", - "description": "This workbook gives an overview of Security Settings for VMs and Azure Arc.", - "dataTypesDependencies": [ "CommonSecurityLog", "SecurityEvent", "Syslog" ], - "dataConnectorsDependencies": [], - "previewImagesFileNames": [ "AzureSentinelSecurityStatusBlack.png", "AzureSentinelSecurityStatusWhite.png" ], - "version": "1.2", - "title": "Security Status", - "templateRelativePath": "SecurityStatus.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "AzureSentinelSecurityAlertsWorkbook", - "logoFileName": "Azure_Sentinel.svg", - "description": "Security Alerts dashboard for alerts in your Azure Sentinel environment.", - "dataTypesDependencies": [ "SecurityAlert" ], - "dataConnectorsDependencies": [], - "previewImagesFileNames": [ "AzureSentinelSecurityAlertsWhite.png", "AzureSentinelSecurityAlertsBlack.png" ], - "version": "1.0", - "title": "Security Alerts", - "templateRelativePath": "AzureSentinelSecurityAlerts.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "SquadraTechnologiesSecRMMWorkbook", - "logoFileName": "SquadraTechnologiesLogo.svg", - "description": "This workbook gives an overview of security data for removable storage activity such as USB thumb drives and USB connected mobile devices.", - "dataTypesDependencies": [ "secRMM_CL" ], - "dataConnectorsDependencies": [ "SquadraTechnologiesSecRmm" ], - "previewImagesFileNames": [ "SquadraTechnologiesSecRMMWhite.PNG", "SquadraTechnologiesSecRMMBlack.PNG" ], - "version": "1.0", - "title": "Squadra Technologies SecRMM - USB removable storage security", - "templateRelativePath": "SquadraTechnologiesSecRMM.json", - "subtitle": "", - "provider": "Squadra Technologies" - }, - { - "workbookKey": "IoT-Alerts", - "logoFileName": "IoTIcon.svg", - "description": "Gain insights into your IoT data workloads from Azure IoT Hub managed deployments, monitor alerts across all your IoT Hub deployments, detect devices at risk and act upon potential threats.", - "dataTypesDependencies": [ "SecurityAlert" ], - "dataConnectorsDependencies": [ "IoT" ], - "previewImagesFileNames": [ "IOTBlack1.png", "IOTWhite1.png" ], - "version": "1.1", - "title": "Azure Security Center for IoT Alerts", - "templateRelativePath": "IOT_Alerts.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "ForcepointCASBWorkbook", - "logoFileName": "FP_Green_Emblem_RGB-01.svg", - "description": "Get insights on user risk with the Forcepoint CASB (Cloud Access Security Broker) workbook.", - "dataTypesDependencies": [ "CommonSecurityLog" ], - "dataConnectorsDependencies": [ "ForcepointCasb" ], - "previewImagesFileNames": [ "ForcepointCASBWhite.png", "ForcepointCASBBlack.png" ], - "version": "1.0", - "title": "Forcepoint Cloud Access Security Broker (CASB)", - "templateRelativePath": "ForcepointCASB.json", - "subtitle": "", - "provider": "Forcepoint" - }, - { - "workbookKey": "ForcepointNGFWWorkbook", - "logoFileName": "FP_Green_Emblem_RGB-01.svg", - "description": "Get insights on firewall activities with the Forcepoint NGFW (Next Generation Firewall) workbook.", - "dataTypesDependencies": [ "CommonSecurityLog" ], - "dataConnectorsDependencies": [ "ForcepointNgfw" ], - "previewImagesFileNames": [ "ForcepointNGFWWhite.png", "ForcepointNGFWBlack.png" ], - "version": "1.0", - "title": "Forcepoint Next Generation Firewall (NGFW)", - "templateRelativePath": "ForcepointNGFW.json", - "subtitle": "", - "provider": "Forcepoint" - }, - { - "workbookKey": "ForcepointDLPWorkbook", - "logoFileName": "FP_Green_Emblem_RGB-01.svg", - "description": "Get insights on DLP incidents with the Forcepoint DLP (Data Loss Prevention) workbook.", - "dataTypesDependencies": [ "ForcepointDLPEvents_CL" ], - "dataConnectorsDependencies": [ "ForcepointDlp" ], - "previewImagesFileNames": [ "ForcepointDLPWhite.png", "ForcepointDLPBlack.png" ], - "version": "1.0", - "title": "Forcepoint Data Loss Prevention (DLP)", - "templateRelativePath": "ForcepointDLP.json", - "subtitle": "", - "provider": "Forcepoint" - }, - { - "workbookKey": "ZimperiumMTDWorkbook", - "logoFileName": "ZIMPERIUM-logo_square2.svg", - "description": "This workbook provides insights on Zimperium Mobile Threat Defense (MTD) threats and mitigations.", - "dataTypesDependencies": [ "ZimperiumThreatLog_CL", "ZimperiumMitigationLog_CL" ], - "dataConnectorsDependencies": [ "ZimperiumMtdAlerts" ], - "previewImagesFileNames": [ "ZimperiumWhite.png", "ZimperiumBlack.png" ], - "version": "1.0", - "title": "Zimperium Mobile Threat Defense (MTD)", - "templateRelativePath": "ZimperiumWorkbooks.json", - "subtitle": "", - "provider": "Zimperium" - }, - { - "workbookKey": "AzureAuditActivityAndSigninWorkbook", - "logoFileName": "azureactivedirectory_logo.svg", - "description": "Gain insights into Azure Active Directory Audit, Activity and Signins with one workbook. This workbook can be used by Security and Azure administrators.", - "dataTypesDependencies": [ "AzureActivity","AuditLogs","SigninLogs" ], - "dataConnectorsDependencies": [ "AzureActiveDirectory" ], - "previewImagesFileNames": ["AzureAuditActivityAndSigninWhite1.png","AzureAuditActivityAndSigninWhite2.png","AzureAuditActivityAndSigninBlack1.png","AzureAuditActivityAndSigninBlack2.png"], - "version": "1.0", - "title": "Azure AD Audit, Activity and Sign-in logs", - "templateRelativePath": "AzureAuditActivityAndSignin.json", - "subtitle": "", - "provider": "Azure Sentinel community" - }, - { - "workbookKey": "WindowsFirewall", - "logoFileName": "Microsoft_logo.svg", - "description": "Gain insights into Windows Firewall logs in combination with security and Azure signin logs", - "dataTypesDependencies": [ "WindowsFirewall","SecurityEvent","SigninLogs" ], - "dataConnectorsDependencies": [ "SecurityEvents", "WindowsFirewall" ], - "previewImagesFileNames": ["WindowsFirewallWhite1.png","WindowsFirewallWhite2.png","WindowsFirewallBlack1.png","WindowsFirewallBlack2.png"], - "version": "1.0", - "title": "Windows Firewall", - "templateRelativePath": "WindowsFirewall.json", - "subtitle": "", - "provider": "Azure Sentinel community" - }, - { - "workbookKey": "EventAnalyzerwWorkbook", - "logoFileName": "", - "description": "The Event Analyzer workbook allows to explore, audit and speed up analysis of Windows Event Logs, including all event details and attributes, such as security, application, system, setup, directory service, DNS and others.", - "dataTypesDependencies": [ "SecurityEvent" ], - "dataConnectorsDependencies": [ "SecurityEvents" ], - "previewImagesFileNames": ["EventAnalyzer-Workbook-White.png", "EventAnalyzer-Workbook-Black.png"], - "version": "1.0", - "title": "Event Analyzer", - "templateRelativePath": "EventAnalyzer.json", - "subtitle": "", - "provider": "Azure Sentinel community" - }, - { - "workbookKey": "ASC-ComplianceandProtection", - "logoFileName": "", - "description": "Gain insight into regulatory compliance, alert trends, security posture, and more with this workbook based on Azure Security Center data.", - "dataTypesDependencies": [ "SecurityAlert", "ProtectionStatus", "SecurityRecommendation", "SecurityBaseline", "SecurityBaselineSummary", "Update", "ConfigurationChange" ], - "dataConnectorsDependencies": [ "AzureSecurityCenter" ], - "previewImagesFileNames": [ "ASCCaPBlack.png", "ASCCaPWhite.png" ], - "version": "1.1", - "title": "ASC Compliance and Protection", - "templateRelativePath": "ASC-ComplianceandProtection.json", - "subtitle": "", - "provider": "Azure Sentinel community" - }, - { - "workbookKey": "AIVectraDetectWorkbook", - "logoFileName": "AIVectraDetect.svg", - "description": "Start investigating network attacks surfaced by Vectra Detect directly from Sentinel. View critical hosts, accounts, campaigns and detections. Also monitor Vectra system health and audit logs.", - "dataTypesDependencies": ["CommonSecurityLog"], - "dataConnectorsDependencies": ["AIVectraDetect"], - "previewImagesFileNames": ["AIVectraDetectWhite1.png", "AIVectraDetectBlack1.png"], - "version": "1.0", - "title": "AI Vectra Detect", - "templateRelativePath": "AIVectraDetectWorkbook.json", - "subtitle": "", - "provider": "Vectra AI" - }, - { - "workbookKey": "Perimeter81OverviewWorkbook", - "logoFileName": "Perimeter81_Logo.svg", - "description": "Gain insights and comprehensive monitoring into your Perimeter 81 account by analyzing activities.", - "dataTypesDependencies": [ "Perimeter81_CL" ], - "dataConnectorsDependencies": [ "Perimeter81ActivityLogs" ], - "previewImagesFileNames": [ "Perimeter81OverviewWhite1.png", "Perimeter81OverviewBlack1.png", "Perimeter81OverviewWhite2.png", "Perimeter81OverviewBlack2.png" ], - "version": "1.0", - "title": "Perimeter 81 Overview", - "templateRelativePath": "Perimeter81OverviewWorkbook.json", - "subtitle": "", - "provider": "Perimeter 81" - }, - { - "workbookKey": "SymantecProxySGWorkbook", - "logoFileName": "symantec_logo.svg", - "description": "Gain insight into Symantec ProxySG by analyzing, collecting and correlating proxy data.\nThis workbook provides visibility into ProxySG Access logs", - "dataTypesDependencies": ["Syslog"], - "dataConnectorsDependencies": [ "SymantecProxySG" ], - "previewImagesFileNames": [ "SymantecProxySGWhite.png", "SymantecProxySGBlack.png" ], - "version": "1.0", - "title": "Symantec ProxySG", - "templateRelativePath": "SymantecProxySG.json", - "subtitle": "", - "provider": "Symantec" - }, - { - "workbookKey": "IllusiveASMWorkbook", - "logoFileName": "illusive_logo_workbook.svg", - "description": "Gain insights into your organization's Cyber Hygiene and Attack Surface risk.\nIllusive ASM automates discovery and clean-up of credential violations, allows drill-down inspection of pathways to critical assets, and provides risk insights that inform intelligent decision-making to reduce attacker mobility.", - "dataTypesDependencies": [ "CommonSecurityLog" ], - "dataConnectorsDependencies": [ "illusiveAttackManagementSystem" ], - "previewImagesFileNames": [ "IllusiveASMWhite.png", "IllusiveASMBlack.png"], - "version": "1.0", - "title": "Illusive ASM Dashboard", - "templateRelativePath": "IllusiveASM.json", - "subtitle": "", - "provider": "Illusive", - "featureFlag": "IllusiveConnector" - }, - { - "workbookKey": "IllusiveADSWorkbook", - "logoFileName": "illusive_logo_workbook.svg", - "description": "Gain insights into unauthorized lateral movement in your organization's network.\nIllusive ADS is designed to paralyzes attackers and eradicates in-network threats by creating a hostile environment for the attackers across all the layers of the attack surface.", - "dataTypesDependencies": [ "CommonSecurityLog" ], - "dataConnectorsDependencies": [ "illusiveAttackManagementSystem" ], - "previewImagesFileNames": [ "IllusiveADSWhite.png", "IllusiveADSBlack.png"], - "version": "1.0", - "title": "Illusive ADS Dashboard", - "templateRelativePath": "IllusiveADS.json", - "subtitle": "", - "provider": "Illusive", - "featureFlag": "IllusiveConnector" - }, - { - "workbookKey": "PulseConnectSecureWorkbook", - "logoFileName": "", - "description": "Gain insight into Pulse Secure VPN by analyzing, collecting and correlating vulnerability data.\nThis workbook provides visibility into user VPN activities", - "dataTypesDependencies": ["Syslog"], - "dataConnectorsDependencies": [ "PulseConnectSecure" ], - "previewImagesFileNames": [ "PulseConnectSecureWhite.png", "PulseConnectSecureBlack.png" ], - "version": "1.0", - "title": "Pulse Connect Secure", - "templateRelativePath": "PulseConnectSecure.json", - "subtitle": "", - "provider": "Pulse Secure", - "featureFlag": "PulseConnectSecureConnector" - }, - { - "workbookKey": "InfobloxNIOSWorkbook", - "logoFileName": "infoblox_logo.svg", - "description": "Gain insight into Infoblox NIOS by analyzing, collecting and correlating DHCP and DNS data.\nThis workbook provides visibility into DHCP and DNS traffic", - "dataTypesDependencies": ["Syslog"], - "dataConnectorsDependencies": [ "InfobloxNIOS" ], - "previewImagesFileNames": [ "InfobloxNIOSWhite.png", "InfobloxNIOSBlack.png" ], - "version": "1.1", - "title": "Infoblox NIOS", - "templateRelativePath": "InfobloxNIOS.json", - "subtitle": "", - "provider": "Infoblox", - "featureFlag": "InfobloxNIOSConnector" - }, - { - "workbookKey": "SymantecVIPWorkbook", - "logoFileName": "symantec_logo.svg", - "description": "Gain insight into Symantec VIP by analyzing, collecting and correlating strong authentication data.\nThis workbook provides visibility into user authentications", - "dataTypesDependencies": ["Syslog"], - "dataConnectorsDependencies": [ "SymantecVIP" ], - "previewImagesFileNames": [ "SymantecVIPWhite.png", "SymantecVIPBlack.png" ], - "version": "1.0", - "title": "Symantec VIP", - "templateRelativePath": "SymantecVIP.json", - "subtitle": "", - "provider": "Symantec", - "featureFlag": "SymantecVIPConnector" - }, - { - "workbookKey": "VMwareCarbonBlackWorkbook", - "logoFileName": "vmwarecarbonblack_logo.svg", - "description": "Gain extensive insight into VMware Carbon Black Cloud - Endpoint Standard by analyzing, collecting and correlating Event logs.\nThis workbook provides visibility into Carbon Black managed endpoints and identified threat event", - "dataTypesDependencies": [ "CarbonBlackEvents_CL","CarbonBlackNotifications_CL","CarbonBlackAuditLogs_CL" ], - "dataConnectorsDependencies": [ "VMwareCarbonBlack" ], - "previewImagesFileNames": [ "VMwareCarbonWhite.png", "VMwareCarbonBlack.png" ], - "version": "1.0", - "title": "VMware Carbon Black", - "templateRelativePath": "VMwareCarbonBlack.json", - "subtitle": "", - "provider": "VMware", - "featureFlag": "VMwareCarbonBlackConnector" - }, - { - "workbookKey": "ProofPointTAPWorkbook", - "logoFileName": "proofpointlogo.svg", - "description": "Gain extensive insight into Proofpoint Targeted Attack Protection (TAP) by analyzing, collecting and correlating TAP log events.\nThis workbook provides visibility into message and click events that were permitted, delivered, or blocked", - "dataTypesDependencies": [ "ProofPointTAPMessagesBlocked_CL", "ProofPointTAPMessagesDelivered_CL", "ProofPointTAPClicksPermitted_CL", "ProofPointTAPClicksBlocked_CL" ], - "dataConnectorsDependencies": [ "ProofpointTAP" ], - "previewImagesFileNames": [ "ProofpointTAPWhite.png", "ProofpointTAPBlack.png" ], - "version": "1.0", - "title": "Proofpoint TAP", - "templateRelativePath": "ProofpointTAP.json", - "subtitle": "", - "provider": "Proofpoint", - "featureFlag": "ProofpointTAPConnector" - }, - { - "workbookKey": "QualysVMWorkbook", - "logoFileName": "qualys_logo.svg", - "description": "Gain insight into Qualys Vulnerability Management by analyzing, collecting and correlating vulnerability data.\nThis workbook provides visibility into vulnerabilities detected from vulnerability scans", - "dataTypesDependencies": ["QualysHostDetection_CL"], - "dataConnectorsDependencies": [ "QualysVulnerabilityManagement" ], - "previewImagesFileNames": [ "QualysVMWhite.png", "QualysVMBlack.png" ], - "version": "1.0", - "title": "Qualys Vulnerability Management", - "templateRelativePath": "QualysVM.json", - "subtitle": "", - "provider": "Qualys", - "featureFlag": "QualysVulnerabilityManagementConnector" - }, - { - "workbookKey": "GitHubSecurityWorkbook", - "logoFileName": "github.svg", - "description": "Gain insights to GitHub activities that may be interesting for security.", - "dataTypesDependencies": [ "Github_CL", "GitHubRepoLogs_CL" ], - "dataConnectorsDependencies": [ ], - "previewImagesFileNames": [ "GitHubSecurityWhite.png", "GitHubSecurityBlack.png"], - "version": "1.0", - "title": "GitHub Security", - "templateRelativePath": "GitHubSecurityWorkbook.json", - "subtitle": "", - "provider": "Azure Sentinel community" - }, - { - "workbookKey": "VisualizationDemo", - "logoFileName": "", - "description": "Learn and explore the many ways of displaying information within Azure Sentinel workbooks", - "dataTypesDependencies": [ "SecurityAlert" ], - "dataConnectorsDependencies": [ ], - "previewImagesFileNames": [ "VisualizationDemoBlack.png","VisualizationDemoWhite.png" ], - "version": "1.0", - "title": "Visualizations Demo", - "templateRelativePath": "VisualizationDemo.json", - "subtitle": "", - "provider": "Azure Sentinel Community" - }, - { - "workbookKey": "SophosXGFirewallWorkbook", - "logoFileName": "sophos_logo.svg", - "description": "Gain insight into Sophos XG Firewall by analyzing, collecting and correlating firewall data.\nThis workbook provides visibility into network traffic", - "dataTypesDependencies": ["Syslog"], - "dataConnectorsDependencies": [ "SophosXGFirewall" ], - "previewImagesFileNames": [ "SophosXGFirewallWhite.png", "SophosXGFirewallBlack.png" ], - "version": "1.0", - "title": "Sophos XG Firewall", - "templateRelativePath": "SophosXGFirewall.json", - "subtitle": "", - "provider": "Sophos", - "featureFlag": "SophosXGFirewallConnector" - }, - { - "workbookKey": "OktaSingleSignOnWorkbook", - "logoFileName": "okta_logo.svg", - "description": "Gain extensive insight into Okta Single Sign-On (SSO) by analyzing, collecting and correlating Audit and Event events.\nThis workbook provides visibility into message and click events that were permitted, delivered, or blocked", - "dataTypesDependencies": [ "Okta_CL" ], - "dataConnectorsDependencies": [ "OktaSSO" ], - "previewImagesFileNames": [ "OktaSingleSignOnWhite.png", "OktaSingleSignOnBlack.png" ], - "version": "1.0", - "title": "Okta Single Sign-On", - "templateRelativePath": "OktaSingleSignOn.json", - "subtitle": "", - "provider": "Okta" - }, - { - "workbookKey": "SysmonThreatHuntingWorkbook", - "logoFileName": "", - "description": "Simplify your threat hunts using Sysmon data mapped to MITRE ATT&CK data. This workbook gives you the ability to drilldown into system activity based on known ATT&CK techniques as well as other threat hunting entry points such as user activity, network connections or virtual machine Sysmon events.\nPlease note that for this workbook to work you must have deployed Sysmon on your virtual machines in line with the instructions at https://github.com/BlueTeamLabs/sentinel-attack/wiki/Onboarding-sysmon-data-to-Azure-Sentinel", - "dataTypesDependencies": ["Event"], - "dataConnectorsDependencies": [], - "previewImagesFileNames": [ "SysmonThreatHuntingWhite1.png", "SysmonThreatHuntingBlack1.png"], - "version": "1.4", - "title": "Sysmon Threat Hunting", - "templateRelativePath": "SysmonThreatHunting.json", - "subtitle": "", - "provider": "Azure Sentinel community" - }, - { - "workbookKey": "WebApplicationFirewallWAFTypeEventsWorkbook", - "logoFileName": "webapplicationfirewall(WAF)_logo.svg", - "description": "Gain insights into your organization's Azure web application firewall (WAF) across various services such as Azure Front Door Service and Application Gateway. You can view event triggers, full messages, attacks over time, among other data. Several aspects of the workbook are interactable to allow users to further understand their data", - "dataTypesDependencies": [ "AzureDiagnostics" ], - "dataConnectorsDependencies": [ "WAF" ], - "previewImagesFileNames": [ "WAFFirewallWAFTypeEventsBlack1.png", "WAFFirewallWAFTypeEventsBlack2.png", "WAFFirewallWAFTypeEventsBlack3.png", "WAFFirewallWAFTypeEventsBlack4.png", "WAFFirewallWAFTypeEventsWhite1.png", "WAFFirewallWAFTypeEventsWhite2.png", "WAFFirewallWAFTypeEventsWhite3.png", "WAFFirewallWAFTypeEventsWhite4.png"], - "version": "1.0", - "title": "Microsoft Web Application Firewall (WAF) - Azure WAF", - "templateRelativePath": "WebApplicationFirewallWAFTypeEvents.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "CyberArkWorkbook", - "logoFileName": "CyberArk_Logo.svg", - "description": "The CyberArk Syslog connector allows you to easily connect all your CyberArk security solution logs with your Azure Sentinel, to view dashboards, create custom alerts, and improve investigation. Integration between CyberArk and Azure Sentinel makes use of the CEF Data Connector to properly parse and display CyberArk Syslog messages.", - "dataTypesDependencies": [ "CommonSecurityLog" ], - "dataConnectorsDependencies": [ "CyberArk" ], - "previewImagesFileNames": [ "CyberArkActivitiesWhite.PNG", "CyberArkActivitiesBlack.PNG" ], - "version": "1.1", - "title": "CyberArk EPV Events", - "templateRelativePath": "CyberArkEPV.json", - "subtitle": "", - "provider": "CyberArk" - }, - { - "workbookKey": "EntityBehaviorAnalyticsWorkbook", - "logoFileName": "Microsoft_logo.svg", - "description": "Identify compromised users and insider threats using entity behavior analytics. Gain insights into anomalous user behavior from baselines learned from behavior patterns", - "dataTypesDependencies": [ "BehaviorAnalytics" ], - "dataConnectorsDependencies": [], - "previewImagesFileNames": [ "EntityBehaviorAnalyticsBlack1.png", "EntityBehaviorAnalyticsWhite1.png" ], - "version": "1.0", - "title": "Entity Behavior Analytics", - "templateRelativePath": "EntityBehaviorAnalytics.json", - "subtitle": "", - "provider": "Microsoft" - }, - { - "workbookKey": "CitrixWAF", - "logoFileName": "citrix_logo.svg", - "description": "Gain insight into the Citrix WAF logs", - "dataTypesDependencies": [ "CommonSecurityLog" ], - "dataConnectorsDependencies": [ "CitrixWAF" ], - "previewImagesFileNames": [ "CitrixWAFBlack.png", "CitrixWAFWhite.png" ], - "version": "1.0", - "title": "Citrix WAF (Web App Firewall)", - "templateRelativePath": "CitrixWAF.json", - "subtitle": "", - "provider": "Citrix Systems Inc." - } -] From 372e1d928bd221bef5bb1698afca60f9971f9099 Mon Sep 17 00:00:00 2001 From: Samik Roy Date: Thu, 17 Sep 2020 23:46:21 +0530 Subject: [PATCH 7/9] Update ExternalUserAddedRemovedInTeams.yaml Query made to detect for an hour. --- .../ExternalUserAddedRemovedInTeams.yaml | 29 ++++++++++--------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/Detections/OfficeActivity/ExternalUserAddedRemovedInTeams.yaml b/Detections/OfficeActivity/ExternalUserAddedRemovedInTeams.yaml index c7193e5e8a3..aeac9d610ad 100644 --- a/Detections/OfficeActivity/ExternalUserAddedRemovedInTeams.yaml +++ b/Detections/OfficeActivity/ExternalUserAddedRemovedInTeams.yaml @@ -3,34 +3,35 @@ name: External user added and removed in short timeframe description: | 'This detection flags the occurances of external user accounts that are added to a Team and then removed within one hour.This data is a part of Office 365 Connector in Azure Sentinel.' +severity: Low +requiredDataConnectors: +- connectorId: Office365 +dataTypes: +- OfficeActivity (Teams) +queryFrequency: 1h +queryPeriod: 1h +triggerOperator: gt +triggerThreshold: 0 tactics: - Persistence relevantTechniques: - T1136 query: | - - // If you want to look at user added further than 7 days ago adjust this value - let time_ago = 7d; - // If you want to change the timeframe of how quickly accounts need to be added and removed change this value - let time_delta = 1h; + OfficeActivity - | where OfficeWorkload == "MicrosoftTeams" - | where TimeGenerated > ago(time_ago) - | where OfficeWorkload == "MicrosoftTeams" - | where TimeGenerated > ago(time_ago) + | where OfficeWorkload =~ "MicrosoftTeams" | where Operation =~ "MemberAdded" | extend UPN = tostring(parse_json(Members)[0].UPN) | where UPN contains ("#EXT#") - | project TimeAdded=TimeGenerated, Operation, UPN, UserWhoAdded = UserId, TeamName=ItemName + | project TimeAdded=TimeGenerated, Operation, UPN, UserWhoAdded = UserId, TeamName | join ( OfficeActivity - | where OfficeWorkload == "MicrosoftTeams" - | where TimeGenerated > ago(time_ago) + | where OfficeWorkload =~ "MicrosoftTeams" | where Operation =~ "MemberRemoved" | extend UPN = tostring(parse_json(Members)[0].UPN) | where UPN contains ("#EXT#") - | project TimeDeleted=TimeGenerated, Operation, UPN, UserWhoDeleted = UserId, TeamName=ItemName + | project TimeDeleted=TimeGenerated, Operation, UPN, UserWhoDeleted = UserId, TeamName ) on UPN - | where TimeDeleted < (TimeAdded + time_delta) + | where TimeDeleted < TimeAdded | project TimeAdded, TimeDeleted, UPN, UserWhoAdded, UserWhoDeleted, TeamName | extend timestamp = TimeAdded, AccountCustomEntity = UPN From 03c8b787d3e75251ecea40d6f4cc7ca54394b172 Mon Sep 17 00:00:00 2001 From: Samik Roy Date: Sat, 26 Sep 2020 00:07:52 +0530 Subject: [PATCH 8/9] Added accidentally removed files. Added accidentally removed files. --- Workbooks/AzureActivity.json | 331 +++++++++++ Workbooks/WorkbooksMetadata.json | 948 +++++++++++++++++++++++++++++++ 2 files changed, 1279 insertions(+) create mode 100644 Workbooks/AzureActivity.json create mode 100644 Workbooks/WorkbooksMetadata.json diff --git a/Workbooks/AzureActivity.json b/Workbooks/AzureActivity.json new file mode 100644 index 00000000000..3f7d2c44c68 --- /dev/null +++ b/Workbooks/AzureActivity.json @@ -0,0 +1,331 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "query": "", + "crossComponentResources": [], + "parameters": [ + { + "id": "52bfbd84-1639-480c-bda5-bfc87fd81832", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 604800000 + }, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 300000 + }, + { + "durationMs": 900000 + }, + { + "durationMs": 1800000 + }, + { + "durationMs": 3600000 + }, + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ] + } + }, + { + "id": "eeb5dcf9-e898-46af-9c12-d91d97e13cd3", + "version": "KqlParameterItem/1.0", + "name": "Caller", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "AzureActivity\r\n| summarize by Caller", + "value": [ + "value::all" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "All" + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "46375a76-7ae1-4d7e-9082-4191531198a9", + "version": "KqlParameterItem/1.0", + "name": "ResourceGroup", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "AzureActivity\r\n| summarize by ResourceGroup", + "value": [ + "value::all" + ], + "typeSettings": { + "resourceTypeFilter": { + "microsoft.resources/resourcegroups": true + }, + "additionalResourceOptions": [ + "value::all" + ], + "selectAllValue": "All" + }, + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = AzureActivity\r\n| where \"{Caller:lable}\" == \"All\" or \"{Caller:lable}\" == \"All\" or Caller in ({Caller})\r\n| where \"{ResourceGroup:lable}\" == \"All\" or \"{ResourceGroup:lable}\" == \"All\" or ResourceGroup in ({ResourceGroup});\r\ndata\r\n| summarize Count = count() by ResourceGroup\r\n| join kind = fullouter (datatable(ResourceGroup:string)['Medium', 'high', 'low']) on ResourceGroup\r\n| project ResourceGroup = iff(ResourceGroup == '', ResourceGroup1, ResourceGroup), Count = iff(ResourceGroup == '', 0, Count)\r\n| join kind = inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ResourceGroup)\r\n on ResourceGroup\r\n| project-away ResourceGroup1, TimeGenerated\r\n| extend ResourceGroups = ResourceGroup\r\n| union (\r\n data \r\n | summarize Count = count() \r\n | extend jkey = 1\r\n | join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n | extend jkey = 1) on jkey\r\n | extend ResourceGroup = 'All', ResourceGroups = '*' \r\n)\r\n| order by Count desc\r\n| take 10", + "size": 4, + "exportToExcelOptions": "visible", + "title": "Top 10 active resource groups", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "ResourceGroup", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "palette": "auto", + "showIcon": true + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "palette": "blueOrange", + "showIcon": true + } + }, + "showBorder": false + } + }, + "name": "query - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AzureActivity\r\n| where \"{Caller:lable}\" == \"All\" or Caller in ({Caller})\r\n| where \"{ResourceGroup:lable}\" == \"All\" or ResourceGroup in ({ResourceGroup})\r\n| summarize deletions = countif(OperationName contains \"Delete\"), creations = countif(OperationName contains \"Create\"), updates = countif(OperationName contains \"Update\"), Activities = count(OperationName) by bin_at(TimeGenerated, 1h, now())\r\n", + "size": 0, + "exportToExcelOptions": "visible", + "title": "Activities over time", + "color": "gray", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "linechart", + "graphSettings": { + "type": 0 + } + }, + "name": "query - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AzureActivity\r\n| where \"{Caller:lable}\" == \"All\" or Caller in ({Caller})\r\n| where \"{ResourceGroup:lable}\" == \"All\" or ResourceGroup in ({ResourceGroup})\r\n| summarize deletions = countif(OperationName contains \"Delete\"), creations = countif(OperationName contains \"Create\"), updates = countif(OperationName contains \"Update\"), Activities = count() by Caller\r\n", + "size": 1, + "exportToExcelOptions": "visible", + "title": "Caller activities", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Caller", + "formatter": 0, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "deletions", + "formatter": 4, + "formatOptions": { + "showIcon": true, + "aggregation": "Count" + } + }, + { + "columnMatch": "creations", + "formatter": 4, + "formatOptions": { + "palette": "purple", + "showIcon": true, + "aggregation": "Count" + } + }, + { + "columnMatch": "updates", + "formatter": 4, + "formatOptions": { + "palette": "gray", + "showIcon": true, + "aggregation": "Count" + } + }, + { + "columnMatch": "Activities", + "formatter": 4, + "formatOptions": { + "palette": "greenDark", + "linkTarget": "GenericDetails", + "linkIsContextBlade": true, + "showIcon": true, + "aggregation": "Count", + "workbookContext": { + "componentIdSource": "workbook", + "resourceIdsSource": "workbook", + "templateIdSource": "static", + "templateId": "https://go.microsoft.com/fwlink/?linkid=874159&resourceId=%2Fsubscriptions%2F44e4eff8-1fcb-4a22-a7d6-992ac7286382%2FresourceGroups%2FSOC&featureName=Workbooks&itemId=%2Fsubscriptions%2F44e4eff8-1fcb-4a22-a7d6-992ac7286382%2Fresourcegroups%2Fsoc%2Fproviders%2Fmicrosoft.insights%2Fworkbooks%2F4c195aec-747f-40bb-addb-934acb3ec646&name=CiscoASA&func=NavigateToPortalFeature&type=workbook", + "typeSource": "workbook", + "gallerySource": "workbook" + } + } + } + ], + "sortBy": [ + { + "itemKey": "$gen_bar_updates_3", + "sortOrder": 2 + } + ], + "labelSettings": [] + } + }, + "name": "query - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AzureActivity \r\n| where \"{Caller:lable}\" == \"All\" or Caller in ({Caller})\r\n| where \"{ResourceGroup:lable}\" == \"All\" or ResourceGroup in ({ResourceGroup})\r\n| summarize Informational = countif(Level == \"Informational\"), Warning = countif(Level == \"Warning\"), Error = countif(Level == \"Error\") by bin_at(TimeGenerated, 1h, now())\r\n", + "size": 0, + "exportToExcelOptions": "visible", + "color": "redBright", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "scatterchart", + "tileSettings": { + "showBorder": false + }, + "graphSettings": { + "type": 2, + "topContent": { + "columnMatch": "Error", + "formatter": 12, + "formatOptions": { + "showIcon": true + } + }, + "hivesContent": { + "columnMatch": "TimeGenerated", + "formatter": 1, + "formatOptions": { + "showIcon": true + } + }, + "nodeIdField": "Error", + "sourceIdField": "Error", + "targetIdField": "Error", + "nodeSize": null, + "staticNodeSize": 100, + "colorSettings": null, + "groupByField": "TimeGenerated", + "hivesMargin": 5 + } + }, + "name": "query - 4" + } + ], + "styleSettings": {}, + "fromTemplateId": "sentinel-AzureActivity", + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json new file mode 100644 index 00000000000..8d110138e2c --- /dev/null +++ b/Workbooks/WorkbooksMetadata.json @@ -0,0 +1,948 @@ +[ + { + "workbookKey": "AzureActivityWorkbook", + "logoFileName": "azureactivity_logo.svg", + "description": "Gain extensive insight into your organization's Azure Activity by analyzing, and correlating all user operations and events.\nYou can learn about all user operations, trends, and anomalous changes over time.\nThis workbook gives you the ability to drill down into caller activities and summarize detected failure and warning events.", + "dataTypesDependencies": [ "AzureActivity" ], + "dataConnectorsDependencies": [ "AzureActivity" ], + "previewImagesFileNames": [ "AzureActivityWhite1.png", "AzureActivityBlack1.png" ], + "version": "1.3", + "title": "Azure Activity", + "templateRelativePath": "AzureActivity.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "IdentityAndAccessWorkbook", + "logoFileName": "Microsoft_logo.svg", + "description": "Gain insights into Identity and access operations by collecting and analyzing security logs, using the audit and sign-in logs to gather insights into use of Microsoft products.\nYou can view anomalies and trends across login events from all users and machines. This workbook also identifies suspicious entities from login and access events.", + "dataTypesDependencies": [ "SecurityEvent" ], + "dataConnectorsDependencies": [ "SecurityEvents" ], + "previewImagesFileNames": [ "IdentityAndAccessWhite.png", "IdentityAndAccessBlack.png" ], + "version": "1.1", + "title": "Identity & Access", + "templateRelativePath": "IdentityAndAccess.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "CheckPointWorkbook", + "logoFileName": "", + "description": "Gain insights into Check Point network activities, including number of gateways and servers, security incidents, and identify infected hosts.", + "dataTypesDependencies": [ "CommonSecurityLog" ], + "dataConnectorsDependencies": [ "CheckPoint" ], + "previewImagesFileNames": [ "CheckPointWhite.png", "CheckPointBlack.png" ], + "version": "1.0", + "title": "Check Point Software Technologies", + "templateRelativePath": "CheckPoint.json", + "subtitle": "", + "provider": "Check Point" + }, + { + "workbookKey": "CiscoWorkbook", + "logoFileName": "cisco_logo.svg", + "description": "Gain insights into your Cisco ASA firewalls by analyzing traffic, events, and firewall operations.\nThis workbook analyzes Cisco ASA threat events and identifies suspicious ports, users, protocols and IP addresses.\nYou can learn about trends across user and data traffic directions, and drill down into the Cisco filter results.\nEasily detect attacks on your organization by monitoring management operations, such as configuration and logins.", + "dataTypesDependencies": [ "CommonSecurityLog" ], + "dataConnectorsDependencies": [ "CiscoASA" ], + "previewImagesFileNames": [ "CiscoWhite.png", "CiscoBlack.png" ], + "version": "1.1", + "title": "Cisco - ASA", + "templateRelativePath": "Cisco.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "ExchangeOnlineWorkbook", + "logoFileName": "office365_logo.svg", + "description": "Gain insights into Microsoft Exchange online by tracing and analyzing all Exchange operations and user activities.\nThis workbook let you monitor user activities, including logins, account operations, permission changes, and mailbox creations to discover suspicious trends among them.", + "dataTypesDependencies": [ "OfficeActivity" ], + "dataConnectorsDependencies": [ "Office365" ], + "previewImagesFileNames": [ "ExchangeOnlineWhite.png", "ExchangeOnlineBlack.png" ], + "version": "1.1", + "title": "Exchange Online", + "templateRelativePath": "ExchangeOnline.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "PaloAltoOverviewWorkbook", + "logoFileName": "paloalto_logo.svg", + "description": "Gain insights and comprehensive monitoring into Palo Alto firewalls by analyzing traffic and activities.\nThis workbook correlates all Palo Alto data with threat events to identify suspicious entities and relationships.\nYou can learn about trends across user and data traffic, and drill down into Palo Alto Wildfire and filter results.", + "dataTypesDependencies": [ "CommonSecurityLog" ], + "dataConnectorsDependencies": [ "PaloAltoNetworks" ], + "previewImagesFileNames": [ "PaloAltoOverviewWhite1.png", "PaloAltoOverviewBlack1.png", "PaloAltoOverviewWhite2.png", "PaloAltoOverviewBlack2.png", "PaloAltoOverviewWhite3.png", "PaloAltoOverviewBlack3.png" ], + "version": "1.1", + "title": "Palo Alto overview", + "templateRelativePath": "PaloAltoOverview.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "PaloAltoNetworkThreatWorkbook", + "logoFileName": "paloalto_logo.svg", + "description": "Gain insights into Palo Alto network activities by analyzing threat events.\nYou can extract meaningful security information by correlating data between threats, applications, and time.\nThis workbook makes it easy to track malware, vulnerability, and virus log events.", + "dataTypesDependencies": [ "CommonSecurityLog" ], + "dataConnectorsDependencies": [ "PaloAltoNetworks" ], + "previewImagesFileNames": [ "PaloAltoNetworkThreatWhite1.png", "PaloAltoNetworkThreatBlack1.png", "PaloAltoNetworkThreatWhite2.png", "PaloAltoNetworkThreatBlack2.png" ], + "version": "1.0", + "title": "Palo Alto Network Threat", + "templateRelativePath": "PaloAltoNetworkThreat.json", + "subtitle": "", + "provider": "Palo Alto Networks" + }, + { + "workbookKey": "EsetSMCWorkbook", + "logoFileName": "eset-logo.svg", + "description": "Visualize events and threats from Eset Security Management Center.", + "dataTypesDependencies": [ "eset_CL" ], + "dataConnectorsDependencies": [ "EsetSMC" ], + "previewImagesFileNames": [ "esetSMCWorkbook-black.png", "esetSMCWorkbook-white.png" ], + "version": "1.0", + "title": "Eset Security Management Center Overview", + "templateRelativePath": "esetSMCWorkbook.json", + "subtitle": "", + "provider": "Community", + "featureFlag": "EsetSMCConnector" + }, + { + "workbookKey": "FortigateWorkbook", + "logoFileName": "fortinet_logo.svg", + "description": "Gain insights into Fortigate firewalls by analyzing traffic and activities.\nThis workbook finds correlations in Fortigate threat events and identifies suspicious ports, users, protocols and IP addresses.\nYou can learn about trends across user and data traffic, and drill down into the Fortigate filter results.\nEasily detect attacks on your organization by monitoring management operations such as configuration and logins.", + "dataTypesDependencies": [ "CommonSecurityLog" ], + "dataConnectorsDependencies": [ "Fortinet" ], + "previewImagesFileNames": [ "FortigateWhite.png", "FortigateBlack.png" ], + "version": "1.1", + "title": "FortiGate", + "templateRelativePath": "Fortigate.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "DnsWorkbook", + "logoFileName": "dns_logo.svg", + "description": "Gain extensive insight into your organization's DNS by analyzing, collecting and correlating all DNS events.\nThis workbook exposes a variety of information about suspicious queries, malicious IP addresses and domain operations.", + "dataTypesDependencies": [ "DnsInventory", "DnsEvents" ], + "dataConnectorsDependencies": [ "DNS" ], + "previewImagesFileNames": [ "DnsWhite.png", "DnsBlack.png" ], + "version": "1.2", + "title": "DNS", + "templateRelativePath": "Dns.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "Office365Workbook", + "logoFileName": "office365_logo.svg", + "description": "Gain insights into Office 365 by tracing and analyzing all operations and activities. You can drill down into your SharePoint, OneDrive, and Exchange.\nThis workbook lets you find usage trends across users, files, folders, and mailboxes, making it easier to identify anomalies in your network.", + "dataTypesDependencies": [ "OfficeActivity" ], + "dataConnectorsDependencies": [ "Office365" ], + "previewImagesFileNames": [ "Office365White1.png", "Office365Black1.png", "Office365White2.png", "Office365Black2.png", "Office365White3.png", "Office365Black3.png" ], + "version": "1.2", + "title": "Office 365", + "templateRelativePath": "Office365.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "SharePointAndOneDriveWorkbook", + "logoFileName": "office365_logo.svg", + "description": "Gain insights into SharePoint and OneDrive by tracing and analyzing all operations and activities.\nYou can view trends across user operation, find correlations between users and files, and identify interesting information such as user IP addresses.", + "dataTypesDependencies": [ "OfficeActivity" ], + "dataConnectorsDependencies": [ "Office365" ], + "previewImagesFileNames": [ "SharePointAndOneDriveBlack1.png", "SharePointAndOneDriveBlack2.png", "SharePointAndOneDriveWhite1.png", "SharePointAndOneDriveWhite2.png" ], + "version": "1.1", + "title": "SharePoint & OneDrive", + "templateRelativePath": "SharePointAndOneDrive.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "AzureActiveDirectorySigninLogsWorkbook", + "logoFileName": "azureactivedirectory_logo.svg", + "description": "Gain insights into Azure Active Directory by connecting Azure Sentinel and using the sign-in logs to gather insights around Azure AD scenarios. \nYou can learn about sign-in operations, such as user sign-ins and locations, email addresses, and IP addresses of your users, as well as failed activities and the errors that triggered the failures.", + "dataTypesDependencies": [ "SigninLogs" ], + "dataConnectorsDependencies": [ "AzureActiveDirectory" ], + "previewImagesFileNames": [ "AADsigninBlack1.png", "AADsigninBlack2.png", "AADsigninWhite1.png", "AADsigninWhite2.png" ], + "version": "1.0", + "title": "Azure AD Sign-in logs", + "templateRelativePath": "AzureActiveDirectorySignins.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "VirtualMachinesInsightsWorkbook", + "logoFileName": "azurevirtualmachine_logo.svg", + "description": "Gain rich insight into your organization's virtual machines from Azure Monitor, which analyzes and correlates data in your VM network. \nYou will get visibility on your VM parameters and behavior, and will be able to trace sent and received data. \nIdentify malicious attackers and their targets, and drill down into the protocols, source and destination IP addresses, countries, and ports the attacks occur across.", + "dataTypesDependencies": [ "VMConnection", "ServiceMapComputer_CL", "ServiceMapProcess_CL" ], + "dataConnectorsDependencies": [], + "previewImagesFileNames": [ "VMInsightBlack1.png", "VMInsightWhite1.png" ], + "version": "1.3", + "title": "VM insights", + "templateRelativePath": "VirtualMachinesInsights.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "AzureActiveDirectoryAuditLogsWorkbook", + "logoFileName": "azureactivedirectory_logo.svg", + "description": "Gain insights into Azure Active Directory by connecting Azure Sentinel and using the audit logs to gather insights around Azure AD scenarios. \nYou can learn about user operations, including password and group management, device activities, and top active users and apps.", + "dataTypesDependencies": [ "AuditLogs" ], + "dataConnectorsDependencies": [ "AzureActiveDirectory" ], + "previewImagesFileNames": [ "AzureADAuditLogsBlack1.png", "AzureADAuditLogsWhite1.png" ], + "version": "1.1", + "title": "Azure AD Audit logs", + "templateRelativePath": "AzureActiveDirectoryAuditLogs.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "ThreatIntelligenceWorkbook", + "logoFileName": "", + "description": "Gain insights into threat indicators, including type and severity of threats, threat activity over time, and correlation with other data sources, including Office 365 and firewalls.", + "dataTypesDependencies": [ "ThreatIntelligenceIndicator", "SecurityAlert" ], + "dataConnectorsDependencies": [ "ThreatIntelligence", "ThreatIntelligenceTaxii" ], + "previewImagesFileNames": [ "ThreatIntelligenceWhite.png", "ThreatIntelligenceBlack.png" ], + "version": "2.0", + "title": "Threat Intelligence", + "templateRelativePath": "ThreatIntelligence.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "WebApplicationFirewallOverviewWorkbook", + "logoFileName": "webapplicationfirewall(WAF)_logo.svg", + "description": "Gain insights into your organization's Azure web application firewall (WAF). You will get a general overview of your application gateway firewall and application gateway access events.", + "dataTypesDependencies": [ "AzureDiagnostics" ], + "dataConnectorsDependencies": [ "WAF" ], + "previewImagesFileNames": [ "WAFOverviewBlack.png", "WAFOverviewWhite.png" ], + "version": "1.1", + "title": "Microsoft Web Application Firewall (WAF) - overview", + "templateRelativePath": "WebApplicationFirewallOverview.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "WebApplicationFirewallFirewallEventsWorkbook", + "logoFileName": "webapplicationfirewall(WAF)_logo.svg", + "description": "Gain insights into your organization's Azure web application firewall (WAF). You will get visibility in to your application gateway firewall. You can view anomalies and trends across all firewall event triggers, attack events, blocked URL addresses and more.", + "dataTypesDependencies": [ "AzureDiagnostics" ], + "dataConnectorsDependencies": [ "WAF" ], + "previewImagesFileNames": [ "WAFFirewallEventsBlack1.png", "WAFFirewallEventsBlack2.png", "WAFFirewallEventsWhite1.png", "WAFFirewallEventsWhite2.png" ], + "version": "1.1", + "title": "Microsoft Web Application Firewall (WAF) - firewall events", + "templateRelativePath": "WebApplicationFirewallFirewallEvents.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "WebApplicationFirewallGatewayAccessEventsWorkbook", + "logoFileName": "webapplicationfirewall(WAF)_logo.svg", + "description": "Gain insights into your organization's Azure web application firewall (WAF). You will get visibility in to your application gateway access events. You can view anomalies and trends across received and sent data, client IP addresses, URL addresses and more, and drill down into details.", + "dataTypesDependencies": [ "AzureDiagnostics" ], + "dataConnectorsDependencies": [ "WAF" ], + "previewImagesFileNames": [ "WAFGatewayAccessEventsBlack1.png", "WAFGatewayAccessEventsBlack2.png", "WAFGatewayAccessEventsWhite1.png", "WAFGatewayAccessEventsWhite2.png" ], + "version": "1.2", + "title": "Microsoft Web Application Firewall (WAF) - gateway access events", + "templateRelativePath": "WebApplicationFirewallGatewayAccessEvents.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "LinuxMachinesWorkbook", + "logoFileName": "azurevirtualmachine_logo.svg", + "description": "Gain insights into your workspaces' Linux machines by connecting Azure Sentinel and using the logs to gather insights around Linux events and errors.", + "dataTypesDependencies": [ "Syslog" ], + "dataConnectorsDependencies": [ "Syslog" ], + "previewImagesFileNames": [ "LinuxMachinesWhite.png", "LinuxMachinesBlack.png" ], + "version": "1.1", + "title": "Linux machines", + "templateRelativePath": "LinuxMachines.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "AzureFirewallWorkbook", + "logoFileName": "", + "description": "Gain insights into Azure Firewall events. You can learn about your application and network rules, see statistics for firewall activities across URLs, ports, and addresses.", + "dataTypesDependencies": [ "AzureDiagnostics" ], + "dataConnectorsDependencies": ["AzureFirewall"], + "previewImagesFileNames": [ "AzureFirewallWhite1.png", "AzureFirewallBlack1.png", "AzureFirewallWhite2.png", "AzureFirewallBlack2.png", "AzureFirewallWhite3.png", "AzureFirewallBlack3.png" ], + "version": "1.0", + "title": "Azure Firewall", + "templateRelativePath": "AzureFirewall.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "MicrosoftCloudAppSecurityWorkbook", + "logoFileName": "Microsoft_logo.svg", + "description": "Using this workbook, you can identify which cloud apps are being used in your organization, gain insights from usage trends and drill down to a specific user and application", + "dataTypesDependencies": [ "McasShadowItReporting" ], + "dataConnectorsDependencies": [ "MicrosoftCloudAppSecurity" ], + "previewImagesFileNames": [ "McasDiscoveryBlack.png", "McasDiscoveryWhite.png" ], + "version": "1.2", + "title": "Microsoft Cloud App Security - discovery logs", + "templateRelativePath": "MicrosoftCloudAppSecurity.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "F5BIGIPSytemMetricsWorkbook", + "logoFileName": "f5_logo.svg", + "description": "Gain insight into F5 BIG-IP health and performance. This workbook provides visibility of various metrics including CPU, memory, connectivity, throughput and disk utilization.", + "dataTypesDependencies": [ "F5Telemetry_system_CL", "F5Telemetry_AVR_CL" ], + "dataConnectorsDependencies": [ "F5BigIp" ], + "previewImagesFileNames": [ "F5SMBlack.png", "F5SMWhite.png" ], + "version": "1.1", + "title": "F5 BIG-IP System Metrics", + "templateRelativePath": "F5BIGIPSystemMetrics.json", + "subtitle": "", + "provider": "F5 Networks" + }, + { + "workbookKey": "F5NetworksWorkbook", + "logoFileName": "f5_logo.svg", + "description": "Gain insights into F5 BIG-IP Application Security Manager (ASM), by analyzing traffic and activities.\nThis workbook provides insight into F5's web application firewall events and identifies attack traffic patterns across multiple ASM instances as well as overall BIG-IP health.", + "dataTypesDependencies": [ "F5Telemetry_LTM_CL", "F5Telemetry_system_CL", "F5Telemetry_ASM_CL" ], + "dataConnectorsDependencies": [ "F5BigIp" ], + "previewImagesFileNames": [ "F5White.png", "F5Black.png" ], + "version": "1.1", + "title": "F5 BIG-IP ASM", + "templateRelativePath": "F5Networks.json", + "subtitle": "", + "provider": "F5 Networks" + }, + { + "workbookKey": "AzureNetworkWatcherWorkbook", + "logoFileName": "networkwatcher_logo.svg", + "description": "Gain deeper understanding of your organization's Azure network traffic by analyzing, and correlating Network Security Group flow logs. \nYou can trace malicious traffic flows, and drill down into their protocols, source and destination IP addresses, machines, countries, and subnets. \nThis workbook also helps you protect your network by identifying weak NSG rules.", + "dataTypesDependencies": [ "AzureNetworkAnalytics_CL" ], + "dataConnectorsDependencies": [], + "previewImagesFileNames": [ "AzureNetworkWatcherWhite.png", "AzureNetworkWatcherBlack.png" ], + "version": "1.1", + "title": "Azure Network Watcher", + "templateRelativePath": "AzureNetworkWatcher.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "ZscalerFirewallWorkbook", + "logoFileName": "zscaler_logo.svg", + "description": "Gain insights into your ZIA cloud firewall logs by connecting to Azure Sentinel.\nThe Zscaler firewall overview workbook provides an overview and ability to drill down into all cloud firewall activity in your Zscaler instance including non-web related networking events, security events, firewall rules, and bandwidth consumption", + "dataTypesDependencies": [ "CommonSecurityLog" ], + "dataConnectorsDependencies": [ "Zscaler" ], + "previewImagesFileNames": [ "ZscalerFirewallWhite1.png", "ZscalerFirewallBlack1.png", "ZscalerFirewallWhite2.png", "ZscalerFirewallBlack2.png" ], + "version": "1.1", + "title": "Zscaler Firewall", + "templateRelativePath": "ZscalerFirewall.json", + "subtitle": "", + "provider": "Zscaler" + }, + { + "workbookKey": "ZscalerWebOverviewWorkbook", + "logoFileName": "zscaler_logo.svg", + "description": "Gain insights into your ZIA web logs by connecting to Azure Sentinel.\nThe Zscaler web overview workbook provides a bird's eye view and ability to drill down into all the security and networking events related to web transactions, types of devices, and bandwidth consumption.", + "dataTypesDependencies": [ "CommonSecurityLog" ], + "dataConnectorsDependencies": [ "Zscaler" ], + "previewImagesFileNames": [ "ZscalerWebOverviewWhite.png", "ZscalerWebOverviewBlack.png" ], + "version": "1.1", + "title": "Zscaler Web Overview", + "templateRelativePath": "ZscalerWebOverview.json", + "subtitle": "", + "provider": "Zscaler" + }, + { + "workbookKey": "ZscalerThreatsOverviewWorkbook", + "logoFileName": "zscaler_logo.svg", + "description": "Gain insights into threats blocked by Zscaler Internet access on your network.\nThe Zscaler threat overview workbook shows your entire threat landscape including blocked malware, IPS/AV rules, and blocked cloud apps. Threats are displayed by threat categories, filetypes, inbound vs outbound threats, usernames, user location, and more.", + "dataTypesDependencies": [ "CommonSecurityLog" ], + "dataConnectorsDependencies": [ "Zscaler" ], + "previewImagesFileNames": [ "ZscalerThreatsWhite.png", "ZscalerThreatsBlack.png" ], + "version": "1.2", + "title": "Zscaler Threats", + "templateRelativePath": "ZscalerThreats.json", + "subtitle": "", + "provider": "Zscaler" + }, + { + "workbookKey": "ZscalerOffice365AppsWorkbook", + "logoFileName": "zscaler_logo.svg", + "description": "Gain insights into Office 365 use on your network.\nThe Zscaler Office 365 overview workbook shows you the Microsoft apps running on your network and their individual bandwidth consumption. It also helps identify phishing attempts in which attackers disguised themselves as Microsoft services.", + "dataTypesDependencies": [ "CommonSecurityLog" ], + "dataConnectorsDependencies": [ "Zscaler" ], + "previewImagesFileNames": [ "ZscalerOffice365White.png", "ZscalerOffice365Black.png" ], + "version": "1.1", + "title": "Zscaler Office365 Apps", + "templateRelativePath": "ZscalerOffice365Apps.json", + "subtitle": "", + "provider": "Zscaler" + }, + { + "workbookKey": "InsecureProtocolsWorkbook", + "logoFileName": "Microsoft_logo.svg", + "description": "Gain insights into insecure protocol traffic by collecting and analyzing security events from Microsoft products.\nYou can view analytics and quickly identify use of weak authentication as well as sources of legacy protocol traffic, like NTLM and SMBv1.\nYou will also have the ability to monitor use of weak ciphers, allowing you to find weak spots in your organization's security.", + "dataTypesDependencies": [ "SecurityEvent", "Event", "SigninLogs" ], + "dataConnectorsDependencies": [ "SecurityEvents", "AzureActiveDirectory" ], + "previewImagesFileNames": [ "InsecureProtocolsWhite1.png", "InsecureProtocolsBlack1.png", "InsecureProtocolsWhite2.png", "InsecureProtocolsBlack2.png" ], + "version": "1.5", + "title": "Insecure Protocols", + "templateRelativePath": "InsecureProtocols.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "AzureInformationProtectionWorkbook", + "logoFileName": "informationProtection.svg", + "description": "The Azure Information Protection Usage report workbook provides information on the volume of labeled and protected documents and emails over time, label distribution of files by label type, along with where the label was applied.", + "dataTypesDependencies": [ "InformationProtectionLogs_CL" ], + "dataConnectorsDependencies": [ "AzureInformationProtection" ], + "previewImagesFileNames": [ "AzureInformationProtectionWhite.png", "AzureInformationProtectionBlack.png" ], + "version": "1.1", + "title": "Azure Information Protecton - Usage Report", + "templateRelativePath": "AzureInformationProtection.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "AmazonWebServicesNetworkActivitiesWorkbook", + "logoFileName": "amazon_web_services_Logo.svg", + "description": "Gain insights into AWS network related resource activities, including the creation, update, and deletions of security groups, network ACLs and routes, gateways, elastic load balancers, VPCs, subnets, and network interfaces.", + "dataTypesDependencies": [ "AWSCloudTrail" ], + "dataConnectorsDependencies": [ "AWS" ], + "previewImagesFileNames": [ "AwsNetworkActivitiesWhite.png", "AwsNetworkActivitiesBlack.png" ], + "version": "1.0", + "title": "AWS Network Activities", + "templateRelativePath": "AmazonWebServicesNetworkActivities.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "AmazonWebServicesUserActivitiesWorkbook", + "logoFileName": "amazon_web_services_Logo.svg", + "description": "Gain insights into AWS user activities, including failed sign-in attempts, IP addresses, regions, user agents, and identity types, as well as potential malicious user activities with assumed roles.", + "dataTypesDependencies": [ "AWSCloudTrail" ], + "dataConnectorsDependencies": [ "AWS" ], + "previewImagesFileNames": [ "AwsUserActivitiesWhite.png", "AwsUserActivitiesBlack.png" ], + "version": "1.0", + "title": "AWS User Activities", + "templateRelativePath": "AmazonWebServicesUserActivities.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "TrendMicroDeepSecurityAttackActivityWorkbook", + "logoFileName": "trendmicro_logo.svg", + "description": "Visualize and gain insights into the MITRE ATT&CK related activity detected by Trend Micro Deep Security.", + "dataTypesDependencies": [ "CommonSecurityLog" ], + "dataConnectorsDependencies": [ "TrendMicro" ], + "previewImagesFileNames": [ "TrendMicroDeepSecurityAttackActivityWhite.png", "TrendMicroDeepSecurityAttackActivityBlack.png" ], + "version": "1.0", + "title": "Trend Micro Deep Security", + "templateRelativePath": "TrendMicroDeepSecurityAttackActivity.json", + "subtitle": "", + "provider": "Trend Micro" + }, + { + "workbookKey": "TrendMicroDeepSecurityOverviewWorkbook", + "logoFileName": "trendmicro_logo.svg", + "description": "Gain insights into your Trend Micro Deep Security security event data by visualizing your Deep Security Anti-Malware, Firewall, Integrity Monitoring, Intrusion Prevention, Log Inspection, and Web Reputation event data.", + "dataTypesDependencies": [ "CommonSecurityLog" ], + "dataConnectorsDependencies": [ "TrendMicro" ], + "previewImagesFileNames": [ "TrendMicroDeepSecurityOverviewWhite1.png", "TrendMicroDeepSecurityOverviewBlack1.png", "TrendMicroDeepSecurityOverviewWhite2.png", "TrendMicroDeepSecurityOverviewBlack2.png" ], + "version": "1.0", + "title": "Trend Micro", + "templateRelativePath": "TrendMicroDeepSecurityOverview.json", + "subtitle": "", + "provider": "Trend Micro" + }, + { + "workbookKey": "ExtraHopDetectionSummaryWorkbook", + "logoFileName": "extrahop_logo.svg", + "description": "Gain insights into ExtraHop Reveal(x) detections by analyzing traffic and activities.\nThis workbook provides an overview of security detections in your organization's network, including high-risk detections and top participants.", + "dataTypesDependencies": [ "CommonSecurityLog" ], + "dataConnectorsDependencies": [ "ExtraHopNetworks" ], + "previewImagesFileNames": [ "ExtrahopWhite.png", "ExtrahopBlack.png" ], + "version": "1.0", + "title": "ExtraHop", + "templateRelativePath": "ExtraHopDetectionSummary.json", + "subtitle": "", + "provider": "ExtraHop Networks" + }, + { + "workbookKey": "BarracudaCloudFirewallWorkbook", + "logoFileName": "barracuda_logo.svg", + "description": "Gain insights into your Barracuda CloudGen Firewall by analyzing firewall operations and events.\nThis workbook provides insights into rule enforcement, network activities, including number of connections, top users, and helps you identify applications that are popular on your network.", + "dataTypesDependencies": [ "CommonSecurityLog", "Syslog" ], + "dataConnectorsDependencies": [ "BarracudaCloudFirewall" ], + "previewImagesFileNames": [ "BarracudaWhite1.png", "BarracudaBlack1.png", "BarracudaWhite2.png", "BarracudaBlack2.png" ], + "version": "1.0", + "title": "Barracuda CloudGen FW", + "templateRelativePath": "Barracuda.json", + "subtitle": "", + "provider": "Barracuda" + }, + { + "workbookKey": "CitrixWorkbook", + "logoFileName": "citrix_logo.svg", + "description": "Citrix Analytics Workbook is one that visualizes the user behavior analysis performed by Citrix Analytics.\nAn admin can troubleshoot and monitor user activities in an enterprise.", + "dataTypesDependencies": [ "CitrixAnalytics_SAlerts_CL", "CitrixAnalytics_SActions_CL", "CitrixAnalytics_SWatchList_CL" ], + "dataConnectorsDependencies": [ "Citrix" ], + "previewImagesFileNames": [ "CitrixWhite.png", "CitrixBlack.png" ], + "version": "2.0", + "title": "Citrix", + "templateRelativePath": "Citrix.json", + "subtitle": "", + "provider": "Citrix Systems Inc." + }, + { + "workbookKey": "OneIdentityWorkbook", + "logoFileName": "oneIdentity_logo.svg", + "description": "This simple workbook gives an overview of sessions going through your SafeGuard for Privileged Sessions device.", + "dataTypesDependencies": [ "CommonSecurityLog" ], + "dataConnectorsDependencies": [ "OneIdentity" ], + "previewImagesFileNames": [ "OneIdentityWhite.png", "OneIdentityBlack.png" ], + "version": "1.0", + "title": "One Identity", + "templateRelativePath": "OneIdentity.json", + "subtitle": "", + "provider": "One Identity LLC." + }, + { + "workbookKey": "SecurityStatusWorkbook", + "logoFileName": "", + "description": "This workbook gives an overview of Security Settings for VMs and Azure Arc.", + "dataTypesDependencies": [ "CommonSecurityLog", "SecurityEvent", "Syslog" ], + "dataConnectorsDependencies": [], + "previewImagesFileNames": [ "AzureSentinelSecurityStatusBlack.png", "AzureSentinelSecurityStatusWhite.png" ], + "version": "1.2", + "title": "Security Status", + "templateRelativePath": "SecurityStatus.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "AzureSentinelSecurityAlertsWorkbook", + "logoFileName": "Azure_Sentinel.svg", + "description": "Security Alerts dashboard for alerts in your Azure Sentinel environment.", + "dataTypesDependencies": [ "SecurityAlert" ], + "dataConnectorsDependencies": [], + "previewImagesFileNames": [ "AzureSentinelSecurityAlertsWhite.png", "AzureSentinelSecurityAlertsBlack.png" ], + "version": "1.1", + "title": "Security Alerts", + "templateRelativePath": "AzureSentinelSecurityAlerts.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "SquadraTechnologiesSecRMMWorkbook", + "logoFileName": "SquadraTechnologiesLogo.svg", + "description": "This workbook gives an overview of security data for removable storage activity such as USB thumb drives and USB connected mobile devices.", + "dataTypesDependencies": [ "secRMM_CL" ], + "dataConnectorsDependencies": [ "SquadraTechnologiesSecRmm" ], + "previewImagesFileNames": [ "SquadraTechnologiesSecRMMWhite.PNG", "SquadraTechnologiesSecRMMBlack.PNG" ], + "version": "1.0", + "title": "Squadra Technologies SecRMM - USB removable storage security", + "templateRelativePath": "SquadraTechnologiesSecRMM.json", + "subtitle": "", + "provider": "Squadra Technologies" + }, + { + "workbookKey": "IoT-Alerts", + "logoFileName": "IoTIcon.svg", + "description": "Gain insights into your IoT data workloads from Azure IoT Hub managed deployments, monitor alerts across all your IoT Hub deployments, detect devices at risk and act upon potential threats.", + "dataTypesDependencies": [ "SecurityAlert" ], + "dataConnectorsDependencies": [ "IoT" ], + "previewImagesFileNames": [ "IOTBlack1.png", "IOTWhite1.png" ], + "version": "1.1", + "title": "Azure Security Center for IoT Alerts", + "templateRelativePath": "IOT_Alerts.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "ForcepointCASBWorkbook", + "logoFileName": "FP_Green_Emblem_RGB-01.svg", + "description": "Get insights on user risk with the Forcepoint CASB (Cloud Access Security Broker) workbook.", + "dataTypesDependencies": [ "CommonSecurityLog" ], + "dataConnectorsDependencies": [ "ForcepointCasb" ], + "previewImagesFileNames": [ "ForcepointCASBWhite.png", "ForcepointCASBBlack.png" ], + "version": "1.0", + "title": "Forcepoint Cloud Access Security Broker (CASB)", + "templateRelativePath": "ForcepointCASB.json", + "subtitle": "", + "provider": "Forcepoint" + }, + { + "workbookKey": "ForcepointNGFWWorkbook", + "logoFileName": "FP_Green_Emblem_RGB-01.svg", + "description": "Get insights on firewall activities with the Forcepoint NGFW (Next Generation Firewall) workbook.", + "dataTypesDependencies": [ "CommonSecurityLog" ], + "dataConnectorsDependencies": [ "ForcepointNgfw" ], + "previewImagesFileNames": [ "ForcepointNGFWWhite.png", "ForcepointNGFWBlack.png" ], + "version": "1.0", + "title": "Forcepoint Next Generation Firewall (NGFW)", + "templateRelativePath": "ForcepointNGFW.json", + "subtitle": "", + "provider": "Forcepoint" + }, + { + "workbookKey": "ForcepointDLPWorkbook", + "logoFileName": "FP_Green_Emblem_RGB-01.svg", + "description": "Get insights on DLP incidents with the Forcepoint DLP (Data Loss Prevention) workbook.", + "dataTypesDependencies": [ "ForcepointDLPEvents_CL" ], + "dataConnectorsDependencies": [ "ForcepointDlp" ], + "previewImagesFileNames": [ "ForcepointDLPWhite.png", "ForcepointDLPBlack.png" ], + "version": "1.0", + "title": "Forcepoint Data Loss Prevention (DLP)", + "templateRelativePath": "ForcepointDLP.json", + "subtitle": "", + "provider": "Forcepoint" + }, + { + "workbookKey": "ZimperiumMTDWorkbook", + "logoFileName": "ZIMPERIUM-logo_square2.svg", + "description": "This workbook provides insights on Zimperium Mobile Threat Defense (MTD) threats and mitigations.", + "dataTypesDependencies": [ "ZimperiumThreatLog_CL", "ZimperiumMitigationLog_CL" ], + "dataConnectorsDependencies": [ "ZimperiumMtdAlerts" ], + "previewImagesFileNames": [ "ZimperiumWhite.png", "ZimperiumBlack.png" ], + "version": "1.0", + "title": "Zimperium Mobile Threat Defense (MTD)", + "templateRelativePath": "ZimperiumWorkbooks.json", + "subtitle": "", + "provider": "Zimperium" + }, + { + "workbookKey": "AzureAuditActivityAndSigninWorkbook", + "logoFileName": "azureactivedirectory_logo.svg", + "description": "Gain insights into Azure Active Directory Audit, Activity and Signins with one workbook. This workbook can be used by Security and Azure administrators.", + "dataTypesDependencies": [ "AzureActivity","AuditLogs","SigninLogs" ], + "dataConnectorsDependencies": [ "AzureActiveDirectory" ], + "previewImagesFileNames": ["AzureAuditActivityAndSigninWhite1.png","AzureAuditActivityAndSigninWhite2.png","AzureAuditActivityAndSigninBlack1.png","AzureAuditActivityAndSigninBlack2.png"], + "version": "1.0", + "title": "Azure AD Audit, Activity and Sign-in logs", + "templateRelativePath": "AzureAuditActivityAndSignin.json", + "subtitle": "", + "provider": "Azure Sentinel community" + }, + { + "workbookKey": "WindowsFirewall", + "logoFileName": "Microsoft_logo.svg", + "description": "Gain insights into Windows Firewall logs in combination with security and Azure signin logs", + "dataTypesDependencies": [ "WindowsFirewall","SecurityEvent","SigninLogs" ], + "dataConnectorsDependencies": [ "SecurityEvents", "WindowsFirewall" ], + "previewImagesFileNames": ["WindowsFirewallWhite1.png","WindowsFirewallWhite2.png","WindowsFirewallBlack1.png","WindowsFirewallBlack2.png"], + "version": "1.0", + "title": "Windows Firewall", + "templateRelativePath": "WindowsFirewall.json", + "subtitle": "", + "provider": "Azure Sentinel community" + }, + { + "workbookKey": "EventAnalyzerwWorkbook", + "logoFileName": "", + "description": "The Event Analyzer workbook allows to explore, audit and speed up analysis of Windows Event Logs, including all event details and attributes, such as security, application, system, setup, directory service, DNS and others.", + "dataTypesDependencies": [ "SecurityEvent" ], + "dataConnectorsDependencies": [ "SecurityEvents" ], + "previewImagesFileNames": ["EventAnalyzer-Workbook-White.png", "EventAnalyzer-Workbook-Black.png"], + "version": "1.0", + "title": "Event Analyzer", + "templateRelativePath": "EventAnalyzer.json", + "subtitle": "", + "provider": "Azure Sentinel community" + }, + { + "workbookKey": "ASC-ComplianceandProtection", + "logoFileName": "", + "description": "Gain insight into regulatory compliance, alert trends, security posture, and more with this workbook based on Azure Security Center data.", + "dataTypesDependencies": [ "SecurityAlert", "ProtectionStatus", "SecurityRecommendation", "SecurityBaseline", "SecurityBaselineSummary", "Update", "ConfigurationChange" ], + "dataConnectorsDependencies": [ "AzureSecurityCenter" ], + "previewImagesFileNames": [ "ASCCaPBlack.png", "ASCCaPWhite.png" ], + "version": "1.1", + "title": "ASC Compliance and Protection", + "templateRelativePath": "ASC-ComplianceandProtection.json", + "subtitle": "", + "provider": "Azure Sentinel community" + }, + { + "workbookKey": "AIVectraDetectWorkbook", + "logoFileName": "AIVectraDetect.svg", + "description": "Start investigating network attacks surfaced by Vectra Detect directly from Sentinel. View critical hosts, accounts, campaigns and detections. Also monitor Vectra system health and audit logs.", + "dataTypesDependencies": ["CommonSecurityLog"], + "dataConnectorsDependencies": ["AIVectraDetect"], + "previewImagesFileNames": ["AIVectraDetectWhite1.png", "AIVectraDetectBlack1.png"], + "version": "1.0", + "title": "AI Vectra Detect", + "templateRelativePath": "AIVectraDetectWorkbook.json", + "subtitle": "", + "provider": "Vectra AI" + }, + { + "workbookKey": "Perimeter81OverviewWorkbook", + "logoFileName": "Perimeter81_Logo.svg", + "description": "Gain insights and comprehensive monitoring into your Perimeter 81 account by analyzing activities.", + "dataTypesDependencies": [ "Perimeter81_CL" ], + "dataConnectorsDependencies": [ "Perimeter81ActivityLogs" ], + "previewImagesFileNames": [ "Perimeter81OverviewWhite1.png", "Perimeter81OverviewBlack1.png", "Perimeter81OverviewWhite2.png", "Perimeter81OverviewBlack2.png" ], + "version": "1.0", + "title": "Perimeter 81 Overview", + "templateRelativePath": "Perimeter81OverviewWorkbook.json", + "subtitle": "", + "provider": "Perimeter 81" + }, + { + "workbookKey": "SymantecProxySGWorkbook", + "logoFileName": "symantec_logo.svg", + "description": "Gain insight into Symantec ProxySG by analyzing, collecting and correlating proxy data.\nThis workbook provides visibility into ProxySG Access logs", + "dataTypesDependencies": ["Syslog"], + "dataConnectorsDependencies": [ "SymantecProxySG" ], + "previewImagesFileNames": [ "SymantecProxySGWhite.png", "SymantecProxySGBlack.png" ], + "version": "1.0", + "title": "Symantec ProxySG", + "templateRelativePath": "SymantecProxySG.json", + "subtitle": "", + "provider": "Symantec" + }, + { + "workbookKey": "IllusiveASMWorkbook", + "logoFileName": "illusive_logo_workbook.svg", + "description": "Gain insights into your organization's Cyber Hygiene and Attack Surface risk.\nIllusive ASM automates discovery and clean-up of credential violations, allows drill-down inspection of pathways to critical assets, and provides risk insights that inform intelligent decision-making to reduce attacker mobility.", + "dataTypesDependencies": [ "CommonSecurityLog" ], + "dataConnectorsDependencies": [ "illusiveAttackManagementSystem" ], + "previewImagesFileNames": [ "IllusiveASMWhite.png", "IllusiveASMBlack.png"], + "version": "1.0", + "title": "Illusive ASM Dashboard", + "templateRelativePath": "IllusiveASM.json", + "subtitle": "", + "provider": "Illusive", + "featureFlag": "IllusiveConnector" + }, + { + "workbookKey": "IllusiveADSWorkbook", + "logoFileName": "illusive_logo_workbook.svg", + "description": "Gain insights into unauthorized lateral movement in your organization's network.\nIllusive ADS is designed to paralyzes attackers and eradicates in-network threats by creating a hostile environment for the attackers across all the layers of the attack surface.", + "dataTypesDependencies": [ "CommonSecurityLog" ], + "dataConnectorsDependencies": [ "illusiveAttackManagementSystem" ], + "previewImagesFileNames": [ "IllusiveADSWhite.png", "IllusiveADSBlack.png"], + "version": "1.0", + "title": "Illusive ADS Dashboard", + "templateRelativePath": "IllusiveADS.json", + "subtitle": "", + "provider": "Illusive", + "featureFlag": "IllusiveConnector" + }, + { + "workbookKey": "PulseConnectSecureWorkbook", + "logoFileName": "", + "description": "Gain insight into Pulse Secure VPN by analyzing, collecting and correlating vulnerability data.\nThis workbook provides visibility into user VPN activities", + "dataTypesDependencies": ["Syslog"], + "dataConnectorsDependencies": [ "PulseConnectSecure" ], + "previewImagesFileNames": [ "PulseConnectSecureWhite.png", "PulseConnectSecureBlack.png" ], + "version": "1.0", + "title": "Pulse Connect Secure", + "templateRelativePath": "PulseConnectSecure.json", + "subtitle": "", + "provider": "Pulse Secure", + "featureFlag": "PulseConnectSecureConnector" + }, + { + "workbookKey": "InfobloxNIOSWorkbook", + "logoFileName": "infoblox_logo.svg", + "description": "Gain insight into Infoblox NIOS by analyzing, collecting and correlating DHCP and DNS data.\nThis workbook provides visibility into DHCP and DNS traffic", + "dataTypesDependencies": ["Syslog"], + "dataConnectorsDependencies": [ "InfobloxNIOS" ], + "previewImagesFileNames": [ "InfobloxNIOSWhite.png", "InfobloxNIOSBlack.png" ], + "version": "1.1", + "title": "Infoblox NIOS", + "templateRelativePath": "InfobloxNIOS.json", + "subtitle": "", + "provider": "Infoblox", + "featureFlag": "InfobloxNIOSConnector" + }, + { + "workbookKey": "SymantecVIPWorkbook", + "logoFileName": "symantec_logo.svg", + "description": "Gain insight into Symantec VIP by analyzing, collecting and correlating strong authentication data.\nThis workbook provides visibility into user authentications", + "dataTypesDependencies": ["Syslog"], + "dataConnectorsDependencies": [ "SymantecVIP" ], + "previewImagesFileNames": [ "SymantecVIPWhite.png", "SymantecVIPBlack.png" ], + "version": "1.0", + "title": "Symantec VIP", + "templateRelativePath": "SymantecVIP.json", + "subtitle": "", + "provider": "Symantec", + "featureFlag": "SymantecVIPConnector" + }, + { + "workbookKey": "VMwareCarbonBlackWorkbook", + "logoFileName": "vmwarecarbonblack_logo.svg", + "description": "Gain extensive insight into VMware Carbon Black Cloud - Endpoint Standard by analyzing, collecting and correlating Event logs.\nThis workbook provides visibility into Carbon Black managed endpoints and identified threat event", + "dataTypesDependencies": [ "CarbonBlackEvents_CL","CarbonBlackNotifications_CL","CarbonBlackAuditLogs_CL" ], + "dataConnectorsDependencies": [ "VMwareCarbonBlack" ], + "previewImagesFileNames": [ "VMwareCarbonWhite.png", "VMwareCarbonBlack.png" ], + "version": "1.0", + "title": "VMware Carbon Black", + "templateRelativePath": "VMwareCarbonBlack.json", + "subtitle": "", + "provider": "VMware", + "featureFlag": "VMwareCarbonBlackConnector" + }, + { + "workbookKey": "ProofPointTAPWorkbook", + "logoFileName": "proofpointlogo.svg", + "description": "Gain extensive insight into Proofpoint Targeted Attack Protection (TAP) by analyzing, collecting and correlating TAP log events.\nThis workbook provides visibility into message and click events that were permitted, delivered, or blocked", + "dataTypesDependencies": [ "ProofPointTAPMessagesBlocked_CL", "ProofPointTAPMessagesDelivered_CL", "ProofPointTAPClicksPermitted_CL", "ProofPointTAPClicksBlocked_CL" ], + "dataConnectorsDependencies": [ "ProofpointTAP" ], + "previewImagesFileNames": [ "ProofpointTAPWhite.png", "ProofpointTAPBlack.png" ], + "version": "1.0", + "title": "Proofpoint TAP", + "templateRelativePath": "ProofpointTAP.json", + "subtitle": "", + "provider": "Proofpoint", + "featureFlag": "ProofpointTAPConnector" + }, + { + "workbookKey": "QualysVMWorkbook", + "logoFileName": "qualys_logo.svg", + "description": "Gain insight into Qualys Vulnerability Management by analyzing, collecting and correlating vulnerability data.\nThis workbook provides visibility into vulnerabilities detected from vulnerability scans", + "dataTypesDependencies": ["QualysHostDetection_CL"], + "dataConnectorsDependencies": [ "QualysVulnerabilityManagement" ], + "previewImagesFileNames": [ "QualysVMWhite.png", "QualysVMBlack.png" ], + "version": "1.0", + "title": "Qualys Vulnerability Management", + "templateRelativePath": "QualysVM.json", + "subtitle": "", + "provider": "Qualys", + "featureFlag": "QualysVulnerabilityManagementConnector" + }, + { + "workbookKey": "GitHubSecurityWorkbook", + "logoFileName": "github.svg", + "description": "Gain insights to GitHub activities that may be interesting for security.", + "dataTypesDependencies": [ "Github_CL", "GitHubRepoLogs_CL" ], + "dataConnectorsDependencies": [ ], + "previewImagesFileNames": [ "GitHubSecurityWhite.png", "GitHubSecurityBlack.png"], + "version": "1.0", + "title": "GitHub Security", + "templateRelativePath": "GitHubSecurityWorkbook.json", + "subtitle": "", + "provider": "Azure Sentinel community" + }, + { + "workbookKey": "VisualizationDemo", + "logoFileName": "", + "description": "Learn and explore the many ways of displaying information within Azure Sentinel workbooks", + "dataTypesDependencies": [ "SecurityAlert" ], + "dataConnectorsDependencies": [ ], + "previewImagesFileNames": [ "VisualizationDemoBlack.png","VisualizationDemoWhite.png" ], + "version": "1.0", + "title": "Visualizations Demo", + "templateRelativePath": "VisualizationDemo.json", + "subtitle": "", + "provider": "Azure Sentinel Community" + }, + { + "workbookKey": "SophosXGFirewallWorkbook", + "logoFileName": "sophos_logo.svg", + "description": "Gain insight into Sophos XG Firewall by analyzing, collecting and correlating firewall data.\nThis workbook provides visibility into network traffic", + "dataTypesDependencies": ["Syslog"], + "dataConnectorsDependencies": [ "SophosXGFirewall" ], + "previewImagesFileNames": [ "SophosXGFirewallWhite.png", "SophosXGFirewallBlack.png" ], + "version": "1.0", + "title": "Sophos XG Firewall", + "templateRelativePath": "SophosXGFirewall.json", + "subtitle": "", + "provider": "Sophos", + "featureFlag": "SophosXGFirewallConnector" + }, + { + "workbookKey": "OktaSingleSignOnWorkbook", + "logoFileName": "okta_logo.svg", + "description": "Gain extensive insight into Okta Single Sign-On (SSO) by analyzing, collecting and correlating Audit and Event events.\nThis workbook provides visibility into message and click events that were permitted, delivered, or blocked", + "dataTypesDependencies": [ "Okta_CL" ], + "dataConnectorsDependencies": [ "OktaSSO" ], + "previewImagesFileNames": [ "OktaSingleSignOnWhite.png", "OktaSingleSignOnBlack.png" ], + "version": "1.0", + "title": "Okta Single Sign-On", + "templateRelativePath": "OktaSingleSignOn.json", + "subtitle": "", + "provider": "Okta" + }, + { + "workbookKey": "SysmonThreatHuntingWorkbook", + "logoFileName": "", + "description": "Simplify your threat hunts using Sysmon data mapped to MITRE ATT&CK data. This workbook gives you the ability to drilldown into system activity based on known ATT&CK techniques as well as other threat hunting entry points such as user activity, network connections or virtual machine Sysmon events.\nPlease note that for this workbook to work you must have deployed Sysmon on your virtual machines in line with the instructions at https://github.com/BlueTeamLabs/sentinel-attack/wiki/Onboarding-sysmon-data-to-Azure-Sentinel", + "dataTypesDependencies": ["Event"], + "dataConnectorsDependencies": [], + "previewImagesFileNames": [ "SysmonThreatHuntingWhite1.png", "SysmonThreatHuntingBlack1.png"], + "version": "1.4", + "title": "Sysmon Threat Hunting", + "templateRelativePath": "SysmonThreatHunting.json", + "subtitle": "", + "provider": "Azure Sentinel community" + }, + { + "workbookKey": "WebApplicationFirewallWAFTypeEventsWorkbook", + "logoFileName": "webapplicationfirewall(WAF)_logo.svg", + "description": "Gain insights into your organization's Azure web application firewall (WAF) across various services such as Azure Front Door Service and Application Gateway. You can view event triggers, full messages, attacks over time, among other data. Several aspects of the workbook are interactable to allow users to further understand their data", + "dataTypesDependencies": [ "AzureDiagnostics" ], + "dataConnectorsDependencies": [ "WAF" ], + "previewImagesFileNames": [ "WAFFirewallWAFTypeEventsBlack1.png", "WAFFirewallWAFTypeEventsBlack2.png", "WAFFirewallWAFTypeEventsBlack3.png", "WAFFirewallWAFTypeEventsBlack4.png", "WAFFirewallWAFTypeEventsWhite1.png", "WAFFirewallWAFTypeEventsWhite2.png", "WAFFirewallWAFTypeEventsWhite3.png", "WAFFirewallWAFTypeEventsWhite4.png"], + "version": "1.0", + "title": "Microsoft Web Application Firewall (WAF) - Azure WAF", + "templateRelativePath": "WebApplicationFirewallWAFTypeEvents.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "CyberArkWorkbook", + "logoFileName": "CyberArk_Logo.svg", + "description": "The CyberArk Syslog connector allows you to easily connect all your CyberArk security solution logs with your Azure Sentinel, to view dashboards, create custom alerts, and improve investigation. Integration between CyberArk and Azure Sentinel makes use of the CEF Data Connector to properly parse and display CyberArk Syslog messages.", + "dataTypesDependencies": [ "CommonSecurityLog" ], + "dataConnectorsDependencies": [ "CyberArk" ], + "previewImagesFileNames": [ "CyberArkActivitiesWhite.PNG", "CyberArkActivitiesBlack.PNG" ], + "version": "1.1", + "title": "CyberArk EPV Events", + "templateRelativePath": "CyberArkEPV.json", + "subtitle": "", + "provider": "CyberArk" + }, + { + "workbookKey": "UserEntityBehaviorAnalyticsWorkbook", + "logoFileName": "Azure_Sentinel.svg", + "description": "Identify compromised users and insider threats using User and Entity Behavior Analytics. Gain insights into anomalous user behavior from baselines learned from behavior patterns", + "dataTypesDependencies": [ "BehaviorAnalytics" ], + "dataConnectorsDependencies": [], + "previewImagesFileNames": [ "UserEntityBehaviorAnalyticsBlack1.png", "UserEntityBehaviorAnalyticsWhite1.png" ], + "version": "1.1", + "title": "User And Entity Behavior Analytics", + "templateRelativePath": "UserEntityBehaviorAnalytics.json", + "subtitle": "", + "provider": "Microsoft" + }, + { + "workbookKey": "CitrixWAF", + "logoFileName": "citrix_logo.svg", + "description": "Gain insight into the Citrix WAF logs", + "dataTypesDependencies": [ "CommonSecurityLog" ], + "dataConnectorsDependencies": [ "CitrixWAF" ], + "previewImagesFileNames": [ "CitrixWAFBlack.png", "CitrixWAFWhite.png" ], + "version": "1.0", + "title": "Citrix WAF (Web App Firewall)", + "templateRelativePath": "CitrixWAF.json", + "subtitle": "", + "provider": "Citrix Systems Inc." + }, + { + "workbookKey": "NormalizedNetworkEventsWorkbook", + "logoFileName": "Azure_Sentinel.svg", + "description": "See insights on multiple networking appliances and other network sessions, that have been parsed or mapped to the normalized networking sessions table. Note this requires enabling parsers for the different products - to learn more, visit https://aka.ms/sentinelnormalizationdocs", + "dataTypesDependencies": [], + "dataConnectorsDependencies": [], + "previewImagesFileNames": [ "NormalizedNetworkEventsWhite.png", "NormalizedNetworkEventsBlack.png" ], + "version": "1.0", + "title": "Normalized network events", + "templateRelativePath": "NormalizedNetworkEvents.json", + "subtitle": "", + "provider": "Microsoft" + } +] From b9f30ec24b0cc4318ebe9a928e48e3caec7eb038 Mon Sep 17 00:00:00 2001 From: Samik Roy Date: Sat, 26 Sep 2020 01:15:47 +0530 Subject: [PATCH 9/9] Update WorkbooksMetadata.json