![](\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/gsa.svg\")
",
+ "Description": "[Global Secure Access](https://aka.ms/GlobalSecureAccess) is a [domain solution](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fsentinel%2Fsentinel-solutions-catalog%23domain-solutions&data=05%7C01%7Ckavishbakshi%40microsoft.com%7Cbe2a496082b24caa4b8c08da9cefacca%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637994850502413731%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=OJegu%2B2EqD7rmYmK9pm9QniD6YWp5ooloZ6tHzcwVi0%3D&reserved=0) and does not include any data connectors. The content in this solution requires one of the product solutions below.\n\n**Prerequisite :-**\n\n Install one or more of the listed solutions to unlock the value provided by this solution.\n 1. Microsoft Entra Id \n\n**Underlying Microsoft Technologies used:** \n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs: \n 1. Product solutions as described above \n",
+ "WorkbookBladeDescription": "This Microsoft Sentinel Solution installs workbooks. Workbooks provide a flexible canvas for data monitoring, analysis, and the creation of rich visual reports within the Azure portal. They allow you to tap into one or many data sources from Microsoft Sentinel and combine them into unified interactive experiences.",
+ "AnalyticalRuleBladeDescription": "This solution installs the following analytic rule templates. After installing the solution, create and enable analytic rules in Manage solution view.",
+ "HuntingQueryBladeDescription": "This solution installs the following hunting queries. After installing the solution, run these hunting queries to hunt for threats in Manage solution view.",
+ "Workbooks": [
+ "Workbooks/GSAM365EnrichedEvents.json",
+ "Workbooks/GSANetworkTraffic.json"
+ ],
+ "Analytic Rules": [
+ "Analytic Rules/Identity - AfterHoursActivity.yaml",
+ "Analytic Rules/Identity - NewCountry.yaml",
+ "Analytic Rules/Identity - SharedSessions.yaml",
+ "Analytic Rules/Office 365 - exchange_auditlogdisabled.yaml",
+ "Analytic Rules/Office 365 - External User added to Team and immediately uploads file.yaml",
+ "Analytic Rules/Office 365 - ExternalUserAddedRemovedInTeams.yaml",
+ "Analytic Rules/Office 365 - Mail_redirect_via_ExO_transport_rule.yaml",
+ "Analytic Rules/Office 365 - Malicious_Inbox_Rule.yaml",
+ "Analytic Rules/Office 365 - MultipleTeamsDeletes.yaml",
+ "Analytic Rules/Office 365 - Office_MailForwarding.yaml",
+ "Analytic Rules/Office 365 - office_policytampering.yaml",
+ "Analytic Rules/Office 365 - Office_Uploaded_Executables.yaml",
+ "Analytic Rules/Office 365 - RareOfficeOperations.yaml",
+ "Analytic Rules/Office 365 - SharePoint_Downloads_byNewIP.yaml",
+ "Analytic Rules/Office 365 - SharePoint_Downloads_byNewUserAgent.yaml",
+ "Analytic Rules/Office 365 - sharepoint_file_transfer_above_threshold.yaml",
+ "Analytic Rules/Office 365 - sharepoint_file_transfer_folders_above_threshold.yaml",
+ "Analytic Rules/SWG - Abnormal Deny Rate.yaml",
+ "Analytic Rules/SWG - Abnormal Port to Protocol.yaml",
+ "Analytic Rules/SWG - Source IP Port Scan.yaml"
+ ],
+ "Playbooks": [],
+ "Hunting Queries": [
+ "Hunting Queries/AnomolousUserAccessingOtherUsersMailbox.yaml",
+ "Hunting Queries/ExternalUserAddedRemovedInTeams_HuntVersion.yaml",
+ "Hunting Queries/ExternalUserFromNewOrgAddedToTeams.yaml",
+ "Hunting Queries/Mail_redirect_via_ExO_transport_rule_hunting.yaml",
+ "Hunting Queries/MultiTeamBot.yaml",
+ "Hunting Queries/MultiTeamOwner.yaml",
+ "Hunting Queries/MultipleTeamsDeletes.yaml",
+ "Hunting Queries/NewBotAddedToTeams.yaml",
+ "Hunting Queries/New_WindowsReservedFileNamesOnOfficeFileServices.yaml",
+ "Hunting Queries/OfficeMailForwarding_hunting.yaml",
+ "Hunting Queries/TeamsFilesUploaded.yaml",
+ "Hunting Queries/UserAddToTeamsAndUploadsFile.yaml",
+ "Hunting Queries/WindowsReservedFileNamesOnOfficeFileServices.yaml",
+ "Hunting Queries/double_file_ext_exes.yaml",
+ "Hunting Queries/new_adminaccountactivity.yaml",
+ "Hunting Queries/new_sharepoint_downloads_by_IP.yaml",
+ "Hunting Queries/new_sharepoint_downloads_by_UserAgent.yaml",
+ "Hunting Queries/nonowner_MailboxLogin.yaml",
+ "Hunting Queries/powershell_or_nonbrowser_MailboxLogin.yaml",
+ "Hunting Queries/sharepoint_downloads.yaml",
+ "Hunting Queries/MultipleUsersEmailForwardedToSameDestination.yaml"
+ ],
+ "Watchlists": [],
+ "WatchlistDescription": "",
+ "BasePath": "C:\\Github\\Azure-Sentinel\\Solutions\\Global Secure Access",
+ "Version": "3.0.0",
+ "Metadata": "SolutionMetadata.json",
+ "TemplateSpec": true,
+ "Is1PConnector": true
+}
diff --git a/Solutions/Global Secure Access/Hunting Queries/AnomolousUserAccessingOtherUsersMailbox.yaml b/Solutions/Global Secure Access/Hunting Queries/AnomolousUserAccessingOtherUsersMailbox.yaml
new file mode 100644
index 00000000000..5a5e54f3638
--- /dev/null
+++ b/Solutions/Global Secure Access/Hunting Queries/AnomolousUserAccessingOtherUsersMailbox.yaml
@@ -0,0 +1,62 @@
+id: 271e8881-3044-4332-a5f4-42264c2e0315
+name: Anomalous access to other users' mailboxes
+description: |
+ 'Looks for users accessing multiple other users' mailboxes or accessing multiple folders in another users mailbox.'
+requiredDataConnectors:
+ - connectorId: AzureActiveDirectory
+ dataTypes:
+ - EnrichedMicrosoft365AuditLogs
+tactics:
+ - Collection
+relevantTechniques:
+ - T1114.002
+tags:
+ - Solorigate
+ - NOBELIUM
+query: |
+ let starttime = todatetime('{{StartTimeISO}}');
+ let endtime = todatetime('{{EndTimeISO}}');
+ let lookback = totimespan((endtime - starttime) * 2);
+ // Adjust this value to alter how many mailbox (other than their own) a user needs to access before being included in results
+ let user_threshold = 1;
+ // Adjust this value to alter how many mailbox folders in other's email accounts a users needs to access before being included in results.
+ let folder_threshold = 5;
+ // Exclude historical as known good (set lookback and timeframe to same value to skip this)
+ EnrichedMicrosoft365AuditLogs
+ | where TimeGenerated between (ago(lookback)..starttime)
+ | where Operation =~ "MailItemsAccessed"
+ | where ResultStatus =~ "Succeeded"
+ | extend MailboxOwnerUPN = tostring(parse_json(AdditionalProperties).MailboxOwnerUPN)
+ | where tolower(MailboxOwnerUPN) != tolower(UserId)
+ | join kind=rightanti (
+ EnrichedMicrosoft365AuditLogs
+ | where TimeGenerated between (starttime..endtime)
+ | where Operation =~ "MailItemsAccessed"
+ | where ResultStatus =~ "Succeeded"
+ | extend MailboxOwnerUPN = tostring(parse_json(AdditionalProperties).MailboxOwnerUPN)
+ | where tolower(MailboxOwnerUPN) != tolower(UserId)
+ ) on MailboxOwnerUPN, UserId
+ | where isnotempty(tostring(parse_json(AdditionalProperties).Folders))
+ | mv-expand Folders = parse_json(AdditionalProperties).Folders
+ | extend folders = tostring(Folders.Path)
+ | extend ClientIP = iif(ClientIp startswith "[", extract("\\[([^\\]]*)", 1, ClientIp), ClientIp)
+ | extend ClientInfoString = tostring(parse_json(AdditionalProperties).ClientInfoString)
+ | extend MailboxGuid = tostring(parse_json(AdditionalProperties).MailboxGuid)
+ | summarize StartTime = max(TimeGenerated), EndTime = min(TimeGenerated), set_folders = make_set(folders, 100000), set_ClientInfoString = make_set(ClientInfoString, 100000), set_ClientIP = make_set(ClientIP, 100000), set_MailboxGuid = make_set(MailboxGuid, 100000), set_MailboxOwnerUPN = make_set(MailboxOwnerUPN, 100000) by UserId
+ | extend folder_count = array_length(set_folders)
+ | extend user_count = array_length(set_MailboxGuid)
+ | where user_count > user_threshold or folder_count > folder_threshold
+ | extend Reason = case(user_count > user_threshold and folder_count > folder_threshold, "Both User and Folder Threshold Exceeded", folder_count > folder_threshold and user_count < user_threshold, "Folder Count Threshold Exceeded", "User Threshold Exceeded")
+ | sort by user_count desc
+ | project-reorder UserId, user_count, folder_count, set_MailboxOwnerUPN, set_ClientIP, set_ClientInfoString, set_folders
+ | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
+ | extend Account_0_Name = AccountName
+ | extend Account_0_UPNSuffix = AccountUPNSuffix
+entityMappings:
+ - entityType: Account
+ fieldMappings:
+ - identifier: Name
+ columnName: AccountName
+ - identifier: UPNSuffix
+ columnName: AccountUPNSuffix
+version: 2.0.1
diff --git a/Solutions/Global Secure Access/Hunting Queries/ExternalUserAddedRemovedInTeams_HuntVersion.yaml b/Solutions/Global Secure Access/Hunting Queries/ExternalUserAddedRemovedInTeams_HuntVersion.yaml
new file mode 100644
index 00000000000..02f36b96d27
--- /dev/null
+++ b/Solutions/Global Secure Access/Hunting Queries/ExternalUserAddedRemovedInTeams_HuntVersion.yaml
@@ -0,0 +1,42 @@
+id: 119d9e1c-afcc-4d23-b239-cdb4e7bf851c
+name: External User Added and Removed in a Short Timeframe
+description: |
+ This hunting query identifies external user accounts that are added to a Team and then removed within one hour.
+requiredDataConnectors:
+ - connectorId: AzureActiveDirectory
+ dataTypes:
+ - EnrichedMicrosoft365AuditLogs
+tactics:
+ - Persistence
+relevantTechniques:
+ - T1136
+query: |
+ // If you want to look at user added further than 7 days ago adjust this value
+ // If you want to change the timeframe of how quickly accounts need to be added and removed change this value
+ let time_delta = 1h;
+ EnrichedMicrosoft365AuditLogs
+ | where Workload == "MicrosoftTeams"
+ | where Operation == "MemberAdded"
+ | extend UPN = tostring(parse_json(tostring(AdditionalProperties)).UPN) // Assuming UPN is stored in AdditionalProperties
+ | where UPN contains "#EXT#"
+ | project TimeAdded = TimeGenerated, Operation, UPN, UserWhoAdded = UserId, TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName), TeamGuid = tostring(parse_json(tostring(AdditionalProperties)).TeamGuid)
+ | join kind=innerunique (
+ EnrichedMicrosoft365AuditLogs
+ | where Workload == "MicrosoftTeams"
+ | where Operation == "MemberRemoved"
+ | extend UPN = tostring(parse_json(tostring(AdditionalProperties)).UPN) // Assuming UPN is stored in AdditionalProperties
+ | where UPN contains "#EXT#"
+ | project TimeDeleted = TimeGenerated, Operation, UPN, UserWhoDeleted = UserId, TeamName = tostring(parse_json(tostring(AdditionalProperties)).TeamName), TeamGuid = tostring(parse_json(tostring(AdditionalProperties)).TeamGuid)
+ ) on UPN, TeamGuid
+ | where TimeDeleted < (TimeAdded + time_delta)
+ | project TimeAdded, TimeDeleted, UPN, UserWhoAdded, UserWhoDeleted, TeamName, TeamGuid
+ | extend AccountName = tostring(split(UPN, "@")[0]), AccountUPNSuffix = tostring(split(UPN, "@")[1])
+entityMappings:
+ - entityType: Account
+ fieldMappings:
+ - identifier: Name
+ columnName: AccountName
+ - identifier: UPNSuffix
+ columnName: AccountUPNSuffix
+version: 2.0.1
+kind: Scheduled
diff --git a/Solutions/Global Secure Access/Hunting Queries/ExternalUserFromNewOrgAddedToTeams.yaml b/Solutions/Global Secure Access/Hunting Queries/ExternalUserFromNewOrgAddedToTeams.yaml
new file mode 100644
index 00000000000..9cee2439f7c
--- /dev/null
+++ b/Solutions/Global Secure Access/Hunting Queries/ExternalUserFromNewOrgAddedToTeams.yaml
@@ -0,0 +1,48 @@
+id: 6fce5baf-bfc2-4c56-a6b7-9c4733fc5a45
+name: External user from a new organisation added to Teams
+description: |
+ 'This query identifies external users added to Teams where the user's domain is not one previously seen in Teams data.'
+requiredDataConnectors:
+ - connectorId: AzureActiveDirectory
+ dataTypes:
+ - EnrichedMicrosoft365AuditLogs
+tactics:
+ - Persistence
+relevantTechniques:
+ - T1136
+query: |
+ let starttime = todatetime('{{StartTimeISO}}');
+ let endtime = todatetime('{{EndTimeISO}}');
+ let lookback = totimespan((endtime - starttime) * 7);
+ let known_orgs = (
+ EnrichedMicrosoft365AuditLogs
+ | where TimeGenerated between (ago(lookback) .. starttime)
+ | where Workload == "MicrosoftTeams"
+ | where Operation in ("MemberAdded", "TeamsSessionStarted")
+ // Extract the correct UPN and parse our external organization domain
+ | extend Members = parse_json(tostring(AdditionalProperties.Members))
+ | extend UPN = iif(Operation == "MemberAdded", tostring(Members[0].UPN), UserId)
+ | extend Organization = tostring(split(split(UPN, "_")[1], "#")[0])
+ | where isnotempty(Organization)
+ | summarize by Organization
+ );
+ EnrichedMicrosoft365AuditLogs
+ | where TimeGenerated between (starttime .. endtime)
+ | where Workload == "MicrosoftTeams"
+ | where Operation == "MemberAdded"
+ | extend Members = parse_json(tostring(AdditionalProperties.Members))
+ | extend UPN = tostring(Members[0].UPN)
+ | extend Organization = tostring(split(split(UPN, "_")[1], "#")[0])
+ | where isnotempty(Organization)
+ | where Organization !in (known_orgs)
+ | extend AccountName = tostring(split(UPN, "@")[0]), AccountUPNSuffix = tostring(split(UPN, "@")[1])
+ | extend Account_0_Name = AccountName
+ | extend Account_0_UPNSuffix = AccountUPNSuffix
+entityMappings:
+ - entityType: Account
+ fieldMappings:
+ - identifier: Name
+ columnName: AccountName
+ - identifier: UPNSuffix
+ columnName: AccountUPNSuffix
+version: 2.0.1
diff --git a/Solutions/Global Secure Access/Hunting Queries/Mail_redirect_via_ExO_transport_rule_hunting.yaml b/Solutions/Global Secure Access/Hunting Queries/Mail_redirect_via_ExO_transport_rule_hunting.yaml
new file mode 100644
index 00000000000..94de9dade23
--- /dev/null
+++ b/Solutions/Global Secure Access/Hunting Queries/Mail_redirect_via_ExO_transport_rule_hunting.yaml
@@ -0,0 +1,42 @@
+id: 9891684a-1e3a-4546-9403-3439513cbc70
+name: Mail Redirect via ExO Transport Rule
+description: |
+ Identifies when Exchange Online transport rule is configured to forward emails.
+ This could be an adversary mailbox configured to collect mail from multiple user accounts.
+requiredDataConnectors:
+ - connectorId: AzureActiveDirectory
+ dataTypes:
+ - EnrichedMicrosoft365AuditLogs
+tactics:
+ - Collection
+ - Exfiltration
+relevantTechniques:
+ - T1114
+ - T1020
+query: |
+ EnrichedMicrosoft365AuditLogs
+ | where Workload == "Exchange"
+ | where Operation in ("New-TransportRule", "Set-TransportRule")
+ | mv-apply DynamicParameters = todynamic(AdditionalProperties.Parameters) on (summarize ParsedParameters = make_bag(pack(tostring(DynamicParameters.Name), DynamicParameters.Value)))
+ | extend RuleName = case(
+ Operation == "Set-TransportRule", ObjectId,
+ Operation == "New-TransportRule", ParsedParameters.Name,
+ "Unknown")
+ | mv-expand ExpandedParameters = todynamic(AdditionalProperties.Parameters)
+ | where ExpandedParameters.Name in ("BlindCopyTo", "RedirectMessageTo") and isnotempty(ExpandedParameters.Value)
+ | extend RedirectTo = ExpandedParameters.Value
+ | extend ClientIPValues = extract_all(@'\[?(::ffff:)?(?PNote: Please refer to the following before installing the solution:
\n• Review the solution Release Notes
\n• There may be known issues pertaining to this Solution, please refer to them before installing.
\nGlobal Secure Access is a domain solution and does not include any data connectors. The content in this solution requires one of the product solutions below.
\nPrerequisite :-
\nInstall one or more of the listed solutions to unlock the value provided by this solution.
\n- \n
- Microsoft Entra Id \n
Underlying Microsoft Technologies used:
\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:
\n- \n
- Product solutions as described above \n
Workbooks: 2, Hunting Queries: 21
\nLearn more about Microsoft Sentinel | Learn more about Solutions
\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "",
+ "contentId": "[variables('_solutionId')]",
+ "parentId": "[variables('_solutionId')]",
+ "source": {
+ "kind": "Solution",
+ "name": "Global Secure Access",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Microsoft",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Microsoft Corporation",
+ "email": "support@microsoft.com",
+ "tier": "Microsoft",
+ "link": "https://support.microsoft.com/"
+ },
+ "dependencies": {
+ "operator": "AND",
+ "criteria": [
+ {
+ "kind": "Workbook",
+ "contentId": "[variables('_workbookContentId1')]",
+ "version": "[variables('workbookVersion1')]"
+ },
+ {
+ "kind": "Workbook",
+ "contentId": "[variables('_workbookContentId2')]",
+ "version": "[variables('workbookVersion2')]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]",
+ "version": "[variables('huntingQueryObject1').huntingQueryVersion1]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]",
+ "version": "[variables('huntingQueryObject2').huntingQueryVersion2]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]",
+ "version": "[variables('huntingQueryObject3').huntingQueryVersion3]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]",
+ "version": "[variables('huntingQueryObject4').huntingQueryVersion4]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]",
+ "version": "[variables('huntingQueryObject5').huntingQueryVersion5]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject6')._huntingQuerycontentId6]",
+ "version": "[variables('huntingQueryObject6').huntingQueryVersion6]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject7')._huntingQuerycontentId7]",
+ "version": "[variables('huntingQueryObject7').huntingQueryVersion7]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject8')._huntingQuerycontentId8]",
+ "version": "[variables('huntingQueryObject8').huntingQueryVersion8]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject9')._huntingQuerycontentId9]",
+ "version": "[variables('huntingQueryObject9').huntingQueryVersion9]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject10')._huntingQuerycontentId10]",
+ "version": "[variables('huntingQueryObject10').huntingQueryVersion10]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject11')._huntingQuerycontentId11]",
+ "version": "[variables('huntingQueryObject11').huntingQueryVersion11]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject12')._huntingQuerycontentId12]",
+ "version": "[variables('huntingQueryObject12').huntingQueryVersion12]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject13')._huntingQuerycontentId13]",
+ "version": "[variables('huntingQueryObject13').huntingQueryVersion13]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject14')._huntingQuerycontentId14]",
+ "version": "[variables('huntingQueryObject14').huntingQueryVersion14]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject15')._huntingQuerycontentId15]",
+ "version": "[variables('huntingQueryObject15').huntingQueryVersion15]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject16')._huntingQuerycontentId16]",
+ "version": "[variables('huntingQueryObject16').huntingQueryVersion16]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject17')._huntingQuerycontentId17]",
+ "version": "[variables('huntingQueryObject17').huntingQueryVersion17]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject18')._huntingQuerycontentId18]",
+ "version": "[variables('huntingQueryObject18').huntingQueryVersion18]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject19')._huntingQuerycontentId19]",
+ "version": "[variables('huntingQueryObject19').huntingQueryVersion19]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject20')._huntingQuerycontentId20]",
+ "version": "[variables('huntingQueryObject20').huntingQueryVersion20]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject21')._huntingQuerycontentId21]",
+ "version": "[variables('huntingQueryObject21').huntingQueryVersion21]"
+ }
+ ]
+ },
+ "firstPublishDate": "2024-04-08",
+ "providers": [
+ "Microsoft"
+ ],
+ "categories": {
+ "domains": [
+ "Identity"
+ ]
+ }
+ },
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]"
+ }
+ ],
+ "outputs": {}
+}
diff --git a/Solutions/Global Secure Access/Package/testParameters.json b/Solutions/Global Secure Access/Package/testParameters.json
new file mode 100644
index 00000000000..42428e73d9b
--- /dev/null
+++ b/Solutions/Global Secure Access/Package/testParameters.json
@@ -0,0 +1,40 @@
+{
+ "location": {
+ "type": "string",
+ "minLength": 1,
+ "defaultValue": "[resourceGroup().location]",
+ "metadata": {
+ "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace"
+ }
+ },
+ "workspace-location": {
+ "type": "string",
+ "defaultValue": "",
+ "metadata": {
+ "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]"
+ }
+ },
+ "workspace": {
+ "defaultValue": "",
+ "type": "string",
+ "metadata": {
+ "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
+ }
+ },
+ "workbook1-name": {
+ "type": "string",
+ "defaultValue": null,
+ "minLength": 1,
+ "metadata": {
+ "description": "Name for the workbook"
+ }
+ },
+ "workbook2-name": {
+ "type": "string",
+ "defaultValue": null,
+ "minLength": 1,
+ "metadata": {
+ "description": "Name for the workbook"
+ }
+ }
+}
diff --git a/Solutions/Global Secure Access/SolutionMetadata.json b/Solutions/Global Secure Access/SolutionMetadata.json
new file mode 100644
index 00000000000..2f6d9a50f6c
--- /dev/null
+++ b/Solutions/Global Secure Access/SolutionMetadata.json
@@ -0,0 +1,15 @@
+{
+ "publisherId": "azuresentinel",
+ "offerId": "azure-sentinel-solution-globalsecureaccess",
+ "firstPublishDate": "2024-04-08",
+ "providers": [ "Microsoft" ],
+ "categories": {
+ "domains": [ "Identity"]
+ },
+ "support": {
+ "tier": "Microsoft",
+ "name": "Microsoft Corporation",
+ "email": "support@microsoft.com",
+ "link": "https://support.microsoft.com/"
+ }
+}
\ No newline at end of file
diff --git a/Solutions/Global Secure Access/Workbooks/GSAM365EnrichedEvents.json b/Solutions/Global Secure Access/Workbooks/GSAM365EnrichedEvents.json
new file mode 100644
index 00000000000..e983bfd5a4c
--- /dev/null
+++ b/Solutions/Global Secure Access/Workbooks/GSAM365EnrichedEvents.json
@@ -0,0 +1,418 @@
+{
+ "version": "Notebook/1.0",
+ "items": [
+ {
+ "type": 1,
+ "content": {
+ "json": "## Traffic Logs workbook\n---\n\nLog information in the dashboard is limited to 30 days."
+ },
+ "name": "text - 2"
+ },
+ {
+ "type": 9,
+ "content": {
+ "version": "KqlParameterItem/1.0",
+ "crossComponentResources": [],
+ "parameters": [
+ {
+ "id": "ff8b2a55-1849-4848-acf8-eab5452e9f10",
+ "version": "KqlParameterItem/1.0",
+ "name": "LogAnalyticWorkspace",
+ "label": "Log Analytic Workspace",
+ "type": 5,
+ "description": "The log analytic workspace in which to execute the queries",
+ "isRequired": true,
+ "query": "resources\r\n| where type == \"microsoft.operationalinsights/workspaces\"\r\n| project id",
+ "typeSettings": {
+ "resourceTypeFilter": {
+ "microsoft.operationalinsights/workspaces": true
+ },
+ "additionalResourceOptions": [
+ "value::1"
+ ],
+ "showDefault": false
+ },
+ "timeContext": {
+ "durationMs": 86400000
+ },
+ "defaultValue": "value::1",
+ "queryType": 1,
+ "resourceType": "microsoft.resourcegraph/resources"
+ },
+ {
+ "id": "f15f34d8-8e2d-4c39-8dee-be2f979c86a8",
+ "version": "KqlParameterItem/1.0",
+ "name": "TimeRange",
+ "label": "Time Range",
+ "type": 4,
+ "isRequired": true,
+ "typeSettings": {
+ "selectableValues": [
+ {
+ "durationMs": 300000
+ },
+ {
+ "durationMs": 900000
+ },
+ {
+ "durationMs": 1800000
+ },
+ {
+ "durationMs": 3600000
+ },
+ {
+ "durationMs": 14400000
+ },
+ {
+ "durationMs": 43200000
+ },
+ {
+ "durationMs": 86400000
+ },
+ {
+ "durationMs": 172800000
+ },
+ {
+ "durationMs": 259200000
+ },
+ {
+ "durationMs": 604800000
+ },
+ {
+ "durationMs": 1209600000
+ },
+ {
+ "durationMs": 2419200000
+ },
+ {
+ "durationMs": 2592000000
+ }
+ ],
+ "allowCustom": true
+ },
+ "timeContext": {
+ "durationMs": 86400000
+ },
+ "value": {
+ "durationMs": 2592000000
+ }
+ },
+ {
+ "id": "8bab511b-53b3-4220-9d1c-372345b06728",
+ "version": "KqlParameterItem/1.0",
+ "name": "Users",
+ "type": 2,
+ "isRequired": true,
+ "multiSelect": true,
+ "quote": "'",
+ "delimiter": ",",
+ "query": "EnrichedMicrosoft365AuditLogsDemos_CL\r\n| summarize Count = count() by UserId_s\r\n| order by Count desc, UserId_s asc\r\n| project Value = UserId_s, Label = strcat(UserId_s, ' - ', Count, ' Logs'), Selected = false",
+ "typeSettings": {
+ "limitSelectTo": 20,
+ "additionalResourceOptions": [
+ "value::all"
+ ],
+ "selectAllValue": "*",
+ "showDefault": false
+ },
+ "timeContext": {
+ "durationMs": 0
+ },
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "value": [
+ "value::all"
+ ]
+ }
+ ],
+ "style": "pills",
+ "queryType": 1,
+ "resourceType": "microsoft.operationalinsights/workspaces"
+ },
+ "name": "parameters - 15"
+ },
+ {
+ "type": 11,
+ "content": {
+ "version": "LinkItem/1.0",
+ "style": "tabs",
+ "links": [
+ {
+ "id": "2b2cd1be-9d25-412c-8444-f005c4789b55",
+ "cellValue": "tabSel",
+ "linkTarget": "parameter",
+ "linkLabel": "Overview",
+ "subTarget": "Overview",
+ "style": "link"
+ },
+ {
+ "id": "cc3e67f2-f20f-4430-8dee-d0773b90d9ce",
+ "cellValue": "tabSel",
+ "linkTarget": "parameter",
+ "linkLabel": "All Traffic",
+ "subTarget": "AllTraffic",
+ "style": "link"
+ }
+ ]
+ },
+ "name": "links - 7"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| project \r\n Timestamp = createdDateTime_t,\r\n User = userPrincipalName_s,\r\n SourceIP = SourceIP,\r\n DestinationIP = destinationIp_s,\r\n DestinationPort = destinationPort_d,\r\n Action = action_s,\r\n PolicyName = policyName_s,\r\n TransportProtocol = transportProtocol_s,\r\n TrafficType = trafficType_s,\r\n DestinationURL = destinationUrl_s,\r\n ReceivedBytes = receivedBytes_d,\r\n SentBytes = sentBytes_d,\r\n DeviceOS = deviceOperatingSystem_s,\r\n PolicyRuleID = policyRuleId_s\r\n| order by Timestamp desc",
+ "size": 3,
+ "showAnalytics": true,
+ "title": "Log",
+ "timeContextFromParameter": "TimeRange",
+ "showExportToExcel": true,
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "gridSettings": {
+ "rowLimit": 1000,
+ "filter": true
+ }
+ },
+ "conditionalVisibility": {
+ "parameterName": "tabSel",
+ "comparison": "isEqualTo",
+ "value": "AllTraffic"
+ },
+ "name": "query - 6"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "// Unique Users\nNetworkAccessDemo_CL\n| extend GeoInfo = geo_info_from_ip_address(SourceIP) // Extend each row with geolocation info\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\n| project SourceIP, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\n| summarize UniqueUsers=dcount(Country)\n| extend snapshot = \"Total Locations\"\n| project col1 = UniqueUsers, snapshot\n\n// Union with Unique Devices\n| union (\n NetworkAccessDemo_CL\n | where userPrincipalName_s in ({Users}) or '*' in ({Users})\n | extend BytesInGB = todouble(sentBytes_d + receivedBytes_d) / (1024 * 1024 * 1024) // Convert bytes to gigabytes\n | summarize TotalBytesGB = sum(BytesInGB)\n | extend snapshot = \"Total Bytes (GB)\"\n | project col1 = tolong(TotalBytesGB), snapshot\n)\n\n// Union with Total Internet Access\n| union (\n NetworkAccessDemo_CL\n | where userPrincipalName_s in ({Users}) or '*' in ({Users})\n | summarize TotalTransactions = count()\n | extend snapshot = \"Total Transactions\"\n | project col1 = TotalTransactions, snapshot\n)\n\n// Union with Total Private Access\n// Order by Snapshot for consistent tile ordering on dashboard\n| order by snapshot",
+ "size": 4,
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "tiles",
+ "tileSettings": {
+ "titleContent": {
+ "columnMatch": "snapshot",
+ "formatter": 1
+ },
+ "leftContent": {
+ "columnMatch": "col1",
+ "formatter": 12,
+ "formatOptions": {
+ "palette": "auto"
+ }
+ },
+ "showBorder": true,
+ "size": "auto"
+ },
+ "mapSettings": {
+ "locInfo": "LatLong",
+ "sizeSettings": "ExistingClients",
+ "sizeAggregation": "Sum",
+ "legendMetric": "ExistingClients",
+ "legendAggregation": "Sum",
+ "itemColorSettings": {
+ "type": "heatmap",
+ "colorAggregation": "Sum",
+ "nodeColorField": "ExistingClients",
+ "heatmapPalette": "greenRed"
+ }
+ },
+ "textSettings": {
+ "style": "bignumber"
+ }
+ },
+ "conditionalVisibility": {
+ "parameterName": "tabSel",
+ "comparison": "isEqualTo",
+ "value": "Overview"
+ },
+ "name": "query - 2"
+ },
+ {
+ "type": 12,
+ "content": {
+ "version": "NotebookGroup/1.0",
+ "groupType": "editable",
+ "items": [
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| extend BytesInGB = todouble(sentBytes_d + receivedBytes_d) / (1024 * 1024 * 1024) // Convert bytes to gigabytes\r\n| summarize TotalBytesGB = sum(BytesInGB) by bin(createdDateTime_t, 1h), trafficType_s\r\n| order by bin(createdDateTime_t, 1h) asc, trafficType_s asc\r\n| project createdDateTime_t, trafficType_s, TotalBytesGB\r\n",
+ "size": 2,
+ "title": "Usage over Time (GB)",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "barchart"
+ },
+ "conditionalVisibility": {
+ "parameterName": "tabSel",
+ "comparison": "isEqualTo",
+ "value": "Overview"
+ },
+ "name": "query - 0"
+ }
+ ]
+ },
+ "name": "group - 5"
+ },
+ {
+ "type": 12,
+ "content": {
+ "version": "NotebookGroup/1.0",
+ "groupType": "editable",
+ "items": [
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIP) // Extend each row with geolocation info\r\n| project createdDateTime_t, SourceIP, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| where Country != \"\"\r\n| summarize Count = count() by City, State, Country\r\n",
+ "size": 0,
+ "title": "Locations",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "map",
+ "mapSettings": {
+ "locInfo": "CountryRegion",
+ "locInfoColumn": "Country",
+ "latitude": "Latitude",
+ "longitude": "Longitude",
+ "sizeSettings": "Count",
+ "sizeAggregation": "Sum",
+ "labelSettings": "Country",
+ "legendMetric": "Country",
+ "legendAggregation": "Count",
+ "itemColorSettings": {
+ "nodeColorField": "Count",
+ "colorAggregation": "Sum",
+ "type": "heatmap",
+ "heatmapPalette": "turquoise"
+ }
+ }
+ },
+ "customWidth": "50",
+ "name": "query - 0"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where tolower(action_s) == \"allow\" and destinationWebCategory_displayName_s != '' // Filter for allowed traffic\r\n| extend firstCategory = tostring(split(destinationWebCategory_displayName_s, ',')[0]) // Split and get the first category\r\n| summarize Count = count() by firstCategory\r\n| top 10 by Count\r\n",
+ "size": 2,
+ "title": "Top Allowed Web Categories",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "piechart"
+ },
+ "customWidth": "50",
+ "name": "query - 7"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where tolower(action_s) == \"block\" and destinationFQDN_s != '' // Filter for allowed traffic\r\n| summarize Count = count() by destinationFQDN_s\r\n| top 100 by Count",
+ "size": 0,
+ "title": "Top Blocked Destinations",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces"
+ },
+ "customWidth": "50",
+ "name": "query - 5"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where tolower(action_s) == \"block\" and destinationWebCategory_displayName_s != '' // Filter for blocked traffic\r\n| extend firstCategory = tostring(split(destinationWebCategory_displayName_s, ',')[0]) // Split and get the first category\r\n| summarize Count = count() by firstCategory\r\n| top 10 by Count\r\n",
+ "size": 3,
+ "title": "Top Blocked Web Categories",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "piechart"
+ },
+ "customWidth": "50",
+ "name": "query - 6"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where sentBytes_d > 0\r\n| where tolower(action_s) != \"block\" \r\n| summarize Count = count() , Sent = sum(sentBytes_d), Recived = sum(receivedBytes_d), Total = sum(receivedBytes_d+ sentBytes_d) by destinationFQDN_s\r\n| order by Count desc\r\n",
+ "size": 0,
+ "title": "Top Allowed Destinations",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "gridSettings": {
+ "formatters": [
+ {
+ "columnMatch": "Count",
+ "formatter": 4,
+ "formatOptions": {
+ "palette": "magenta"
+ }
+ },
+ {
+ "columnMatch": "Recived",
+ "formatter": 4,
+ "formatOptions": {
+ "palette": "turquoise"
+ }
+ },
+ {
+ "columnMatch": "Total",
+ "formatter": 4,
+ "formatOptions": {
+ "palette": "pink"
+ }
+ },
+ {
+ "columnMatch": "Sent",
+ "formatter": 4,
+ "formatOptions": {
+ "palette": "blue"
+ }
+ }
+ ]
+ }
+ },
+ "customWidth": "50",
+ "name": "query - 1"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where transportProtocol_s != ''\r\n| summarize Count = count() by toupper(transportProtocol_s)\r\n| top 10 by Count\r\n",
+ "size": 2,
+ "title": "Protocol Distburion",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "piechart"
+ },
+ "customWidth": "50",
+ "name": "query - 3"
+ }
+ ]
+ },
+ "conditionalVisibility": {
+ "parameterName": "tabSel",
+ "comparison": "isEqualTo",
+ "value": "Overview"
+ },
+ "name": "group - 4"
+ }
+ ],
+ "fallbackResourceIds": [],
+ "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
+}
diff --git a/Solutions/Global Secure Access/Workbooks/GSANetworkTraffic.json b/Solutions/Global Secure Access/Workbooks/GSANetworkTraffic.json
new file mode 100644
index 00000000000..75f2f99880b
--- /dev/null
+++ b/Solutions/Global Secure Access/Workbooks/GSANetworkTraffic.json
@@ -0,0 +1,421 @@
+{
+ "version": "Notebook/1.0",
+ "items": [
+ {
+ "type": 1,
+ "content": {
+ "json": "## Traffic Logs workbook\n---\n\nLog information in the dashboard is limited to 30 days."
+ },
+ "name": "text - 2"
+ },
+ {
+ "type": 9,
+ "content": {
+ "version": "KqlParameterItem/1.0",
+ "crossComponentResources": [
+ ""
+ ],
+ "parameters": [
+ {
+ "id": "ff8b2a55-1849-4848-acf8-eab5452e9f10",
+ "version": "KqlParameterItem/1.0",
+ "name": "LogAnalyticWorkspace",
+ "label": "Log Analytic Workspace",
+ "type": 5,
+ "description": "The log analytic workspace in which to execute the queries",
+ "isRequired": true,
+ "query": "resources\r\n| where type == \"microsoft.operationalinsights/workspaces\"\r\n| project id",
+ "typeSettings": {
+ "resourceTypeFilter": {
+ "microsoft.operationalinsights/workspaces": true
+ },
+ "additionalResourceOptions": [
+ "value::1"
+ ],
+ "showDefault": false
+ },
+ "timeContext": {
+ "durationMs": 86400000
+ },
+ "defaultValue": "value::1",
+ "queryType": 1,
+ "resourceType": "microsoft.resourcegraph/resources"
+ },
+ {
+ "id": "f15f34d8-8e2d-4c39-8dee-be2f979c86a8",
+ "version": "KqlParameterItem/1.0",
+ "name": "TimeRange",
+ "label": "Time Range",
+ "type": 4,
+ "isRequired": true,
+ "typeSettings": {
+ "selectableValues": [
+ {
+ "durationMs": 300000
+ },
+ {
+ "durationMs": 900000
+ },
+ {
+ "durationMs": 1800000
+ },
+ {
+ "durationMs": 3600000
+ },
+ {
+ "durationMs": 14400000
+ },
+ {
+ "durationMs": 43200000
+ },
+ {
+ "durationMs": 86400000
+ },
+ {
+ "durationMs": 172800000
+ },
+ {
+ "durationMs": 259200000
+ },
+ {
+ "durationMs": 604800000
+ },
+ {
+ "durationMs": 1209600000
+ },
+ {
+ "durationMs": 2419200000
+ },
+ {
+ "durationMs": 2592000000
+ }
+ ],
+ "allowCustom": true
+ },
+ "timeContext": {
+ "durationMs": 86400000
+ },
+ "value": {
+ "durationMs": 2592000000
+ }
+ },
+ {
+ "id": "8bab511b-53b3-4220-9d1c-372345b06728",
+ "version": "KqlParameterItem/1.0",
+ "name": "Users",
+ "type": 2,
+ "isRequired": true,
+ "multiSelect": true,
+ "quote": "'",
+ "delimiter": ",",
+ "query": "EnrichedMicrosoft365AuditLogsDemos_CL\r\n| summarize Count = count() by UserId_s\r\n| order by Count desc, UserId_s asc\r\n| project Value = UserId_s, Label = strcat(UserId_s, ' - ', Count, ' Logs'), Selected = false",
+ "typeSettings": {
+ "limitSelectTo": 20,
+ "additionalResourceOptions": [
+ "value::all"
+ ],
+ "selectAllValue": "*",
+ "showDefault": false
+ },
+ "timeContext": {
+ "durationMs": 0
+ },
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "value": [
+ "value::all"
+ ]
+ }
+ ],
+ "style": "pills",
+ "queryType": 1,
+ "resourceType": "microsoft.operationalinsights/workspaces"
+ },
+ "name": "parameters - 15"
+ },
+ {
+ "type": 11,
+ "content": {
+ "version": "LinkItem/1.0",
+ "style": "tabs",
+ "links": [
+ {
+ "id": "2b2cd1be-9d25-412c-8444-f005c4789b55",
+ "cellValue": "tabSel",
+ "linkTarget": "parameter",
+ "linkLabel": "Overview",
+ "subTarget": "Overview",
+ "style": "link"
+ },
+ {
+ "id": "cc3e67f2-f20f-4430-8dee-d0773b90d9ce",
+ "cellValue": "tabSel",
+ "linkTarget": "parameter",
+ "linkLabel": "All Traffic",
+ "subTarget": "AllTraffic",
+ "style": "link"
+ }
+ ]
+ },
+ "name": "links - 7"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| project \r\n Timestamp = createdDateTime_t,\r\n User = userPrincipalName_s,\r\n SourceIP = SourceIP,\r\n DestinationIP = destinationIp_s,\r\n DestinationPort = destinationPort_d,\r\n Action = action_s,\r\n PolicyName = policyName_s,\r\n TransportProtocol = transportProtocol_s,\r\n TrafficType = trafficType_s,\r\n DestinationURL = destinationUrl_s,\r\n ReceivedBytes = receivedBytes_d,\r\n SentBytes = sentBytes_d,\r\n DeviceOS = deviceOperatingSystem_s,\r\n PolicyRuleID = policyRuleId_s\r\n| order by Timestamp desc",
+ "size": 3,
+ "showAnalytics": true,
+ "title": "Log",
+ "timeContextFromParameter": "TimeRange",
+ "showExportToExcel": true,
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "gridSettings": {
+ "rowLimit": 1000,
+ "filter": true
+ }
+ },
+ "conditionalVisibility": {
+ "parameterName": "tabSel",
+ "comparison": "isEqualTo",
+ "value": "AllTraffic"
+ },
+ "name": "query - 6"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "// Unique Users\nNetworkAccessDemo_CL\n| extend GeoInfo = geo_info_from_ip_address(SourceIP) // Extend each row with geolocation info\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\n| project SourceIP, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\n| summarize UniqueUsers=dcount(Country)\n| extend snapshot = \"Total Locations\"\n| project col1 = UniqueUsers, snapshot\n\n// Union with Unique Devices\n| union (\n NetworkAccessDemo_CL\n | where userPrincipalName_s in ({Users}) or '*' in ({Users})\n | extend BytesInGB = todouble(sentBytes_d + receivedBytes_d) / (1024 * 1024 * 1024) // Convert bytes to gigabytes\n | summarize TotalBytesGB = sum(BytesInGB)\n | extend snapshot = \"Total Bytes (GB)\"\n | project col1 = tolong(TotalBytesGB), snapshot\n)\n\n// Union with Total Internet Access\n| union (\n NetworkAccessDemo_CL\n | where userPrincipalName_s in ({Users}) or '*' in ({Users})\n | summarize TotalTransactions = count()\n | extend snapshot = \"Total Trasnacations\"\n | project col1 = TotalTransactions, snapshot\n)\n\n// Union with Total Private Access\n// Order by Snapshot for consistent tile ordering on dashboard\n| order by snapshot",
+ "size": 4,
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "tiles",
+ "tileSettings": {
+ "titleContent": {
+ "columnMatch": "snapshot",
+ "formatter": 1
+ },
+ "leftContent": {
+ "columnMatch": "col1",
+ "formatter": 12,
+ "formatOptions": {
+ "palette": "auto"
+ }
+ },
+ "showBorder": true,
+ "size": "auto"
+ },
+ "mapSettings": {
+ "locInfo": "LatLong",
+ "sizeSettings": "ExistingClients",
+ "sizeAggregation": "Sum",
+ "legendMetric": "ExistingClients",
+ "legendAggregation": "Sum",
+ "itemColorSettings": {
+ "type": "heatmap",
+ "colorAggregation": "Sum",
+ "nodeColorField": "ExistingClients",
+ "heatmapPalette": "greenRed"
+ }
+ },
+ "textSettings": {
+ "style": "bignumber"
+ }
+ },
+ "conditionalVisibility": {
+ "parameterName": "tabSel",
+ "comparison": "isEqualTo",
+ "value": "Overview"
+ },
+ "name": "query - 2"
+ },
+ {
+ "type": 12,
+ "content": {
+ "version": "NotebookGroup/1.0",
+ "groupType": "editable",
+ "items": [
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| extend BytesInGB = todouble(sentBytes_d + receivedBytes_d) / (1024 * 1024 * 1024) // Convert bytes to gigabytes\r\n| summarize TotalBytesGB = sum(BytesInGB) by bin(createdDateTime_t, 1h), trafficType_s\r\n| order by bin(createdDateTime_t, 1h) asc, trafficType_s asc\r\n| project createdDateTime_t, trafficType_s, TotalBytesGB\r\n",
+ "size": 2,
+ "title": "Usage over Time (GB)",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "barchart"
+ },
+ "conditionalVisibility": {
+ "parameterName": "tabSel",
+ "comparison": "isEqualTo",
+ "value": "Overview"
+ },
+ "name": "query - 0"
+ }
+ ]
+ },
+ "name": "group - 5"
+ },
+ {
+ "type": 12,
+ "content": {
+ "version": "NotebookGroup/1.0",
+ "groupType": "editable",
+ "items": [
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIP) // Extend each row with geolocation info\r\n| project createdDateTime_t, SourceIP, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| where Country != \"\"\r\n| summarize Count = count() by City, State, Country\r\n\r\n",
+ "size": 0,
+ "title": "Locations",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "map",
+ "mapSettings": {
+ "locInfo": "CountryRegion",
+ "locInfoColumn": "Country",
+ "latitude": "Latitude",
+ "longitude": "Longitude",
+ "sizeSettings": "Count",
+ "sizeAggregation": "Sum",
+ "labelSettings": "Country",
+ "legendMetric": "Country",
+ "legendAggregation": "Count",
+ "itemColorSettings": {
+ "nodeColorField": "Count",
+ "colorAggregation": "Sum",
+ "type": "heatmap",
+ "heatmapPalette": "turquoise"
+ }
+ }
+ },
+ "customWidth": "50",
+ "name": "query - 0"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where tolower(action_s) == \"allow\" and destinationWebCategory_displayName_s != '' // Filter for allowed traffic\r\n| extend firstCategory = tostring(split(destinationWebCategory_displayName_s, ',')[0]) // Split and get the first category\r\n| summarize Count = count() by firstCategory\r\n| top 10 by Count\r\n",
+ "size": 2,
+ "title": "Top Allowed Web Categories",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "piechart"
+ },
+ "customWidth": "50",
+ "name": "query - 7"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where tolower(action_s) == \"block\" and destinationFQDN_s != '' // Filter for allowed traffic\r\n| summarize Count = count() by destinationFQDN_s\r\n| top 100 by Count",
+ "size": 0,
+ "title": "Top Blocked Destinations",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces"
+ },
+ "customWidth": "50",
+ "name": "query - 5"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where tolower(action_s) == \"block\" and destinationWebCategory_displayName_s != '' // Filter for blocked traffic\r\n| extend firstCategory = tostring(split(destinationWebCategory_displayName_s, ',')[0]) // Split and get the first category\r\n| summarize Count = count() by firstCategory\r\n| top 10 by Count\r\n",
+ "size": 3,
+ "title": "Top Blocked Web Categories",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "piechart"
+ },
+ "customWidth": "50",
+ "name": "query - 6"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where sentBytes_d > 0\r\n| where tolower(action_s) != \"block\" \r\n| summarize Count = count() , Sent = sum(sentBytes_d), Recived = sum(receivedBytes_d), Total = sum(receivedBytes_d+ sentBytes_d) by destinationFQDN_s\r\n| order by Count desc\r\n",
+ "size": 0,
+ "title": "Top Allowed Destinations",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "gridSettings": {
+ "formatters": [
+ {
+ "columnMatch": "Count",
+ "formatter": 4,
+ "formatOptions": {
+ "palette": "magenta"
+ }
+ },
+ {
+ "columnMatch": "Recived",
+ "formatter": 4,
+ "formatOptions": {
+ "palette": "turquoise"
+ }
+ },
+ {
+ "columnMatch": "Total",
+ "formatter": 4,
+ "formatOptions": {
+ "palette": "pink"
+ }
+ },
+ {
+ "columnMatch": "Sent",
+ "formatter": 4,
+ "formatOptions": {
+ "palette": "blue"
+ }
+ }
+ ]
+ }
+ },
+ "customWidth": "50",
+ "name": "query - 1"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where transportProtocol_s != ''\r\n| summarize Count = count() by toupper(transportProtocol_s)\r\n| top 10 by Count\r\n",
+ "size": 2,
+ "title": "Protocol Distburion",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "piechart"
+ },
+ "customWidth": "50",
+ "name": "query - 3"
+ }
+ ]
+ },
+ "conditionalVisibility": {
+ "parameterName": "tabSel",
+ "comparison": "isEqualTo",
+ "value": "Overview"
+ },
+ "name": "group - 4"
+ }
+ ],
+ "fallbackResourceIds": [
+ ],
+ "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
+}
\ No newline at end of file
diff --git a/Workbooks/GSAM365EnrichedEvents.json b/Workbooks/GSAM365EnrichedEvents.json
new file mode 100644
index 00000000000..e983bfd5a4c
--- /dev/null
+++ b/Workbooks/GSAM365EnrichedEvents.json
@@ -0,0 +1,418 @@
+{
+ "version": "Notebook/1.0",
+ "items": [
+ {
+ "type": 1,
+ "content": {
+ "json": "## Traffic Logs workbook\n---\n\nLog information in the dashboard is limited to 30 days."
+ },
+ "name": "text - 2"
+ },
+ {
+ "type": 9,
+ "content": {
+ "version": "KqlParameterItem/1.0",
+ "crossComponentResources": [],
+ "parameters": [
+ {
+ "id": "ff8b2a55-1849-4848-acf8-eab5452e9f10",
+ "version": "KqlParameterItem/1.0",
+ "name": "LogAnalyticWorkspace",
+ "label": "Log Analytic Workspace",
+ "type": 5,
+ "description": "The log analytic workspace in which to execute the queries",
+ "isRequired": true,
+ "query": "resources\r\n| where type == \"microsoft.operationalinsights/workspaces\"\r\n| project id",
+ "typeSettings": {
+ "resourceTypeFilter": {
+ "microsoft.operationalinsights/workspaces": true
+ },
+ "additionalResourceOptions": [
+ "value::1"
+ ],
+ "showDefault": false
+ },
+ "timeContext": {
+ "durationMs": 86400000
+ },
+ "defaultValue": "value::1",
+ "queryType": 1,
+ "resourceType": "microsoft.resourcegraph/resources"
+ },
+ {
+ "id": "f15f34d8-8e2d-4c39-8dee-be2f979c86a8",
+ "version": "KqlParameterItem/1.0",
+ "name": "TimeRange",
+ "label": "Time Range",
+ "type": 4,
+ "isRequired": true,
+ "typeSettings": {
+ "selectableValues": [
+ {
+ "durationMs": 300000
+ },
+ {
+ "durationMs": 900000
+ },
+ {
+ "durationMs": 1800000
+ },
+ {
+ "durationMs": 3600000
+ },
+ {
+ "durationMs": 14400000
+ },
+ {
+ "durationMs": 43200000
+ },
+ {
+ "durationMs": 86400000
+ },
+ {
+ "durationMs": 172800000
+ },
+ {
+ "durationMs": 259200000
+ },
+ {
+ "durationMs": 604800000
+ },
+ {
+ "durationMs": 1209600000
+ },
+ {
+ "durationMs": 2419200000
+ },
+ {
+ "durationMs": 2592000000
+ }
+ ],
+ "allowCustom": true
+ },
+ "timeContext": {
+ "durationMs": 86400000
+ },
+ "value": {
+ "durationMs": 2592000000
+ }
+ },
+ {
+ "id": "8bab511b-53b3-4220-9d1c-372345b06728",
+ "version": "KqlParameterItem/1.0",
+ "name": "Users",
+ "type": 2,
+ "isRequired": true,
+ "multiSelect": true,
+ "quote": "'",
+ "delimiter": ",",
+ "query": "EnrichedMicrosoft365AuditLogsDemos_CL\r\n| summarize Count = count() by UserId_s\r\n| order by Count desc, UserId_s asc\r\n| project Value = UserId_s, Label = strcat(UserId_s, ' - ', Count, ' Logs'), Selected = false",
+ "typeSettings": {
+ "limitSelectTo": 20,
+ "additionalResourceOptions": [
+ "value::all"
+ ],
+ "selectAllValue": "*",
+ "showDefault": false
+ },
+ "timeContext": {
+ "durationMs": 0
+ },
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "value": [
+ "value::all"
+ ]
+ }
+ ],
+ "style": "pills",
+ "queryType": 1,
+ "resourceType": "microsoft.operationalinsights/workspaces"
+ },
+ "name": "parameters - 15"
+ },
+ {
+ "type": 11,
+ "content": {
+ "version": "LinkItem/1.0",
+ "style": "tabs",
+ "links": [
+ {
+ "id": "2b2cd1be-9d25-412c-8444-f005c4789b55",
+ "cellValue": "tabSel",
+ "linkTarget": "parameter",
+ "linkLabel": "Overview",
+ "subTarget": "Overview",
+ "style": "link"
+ },
+ {
+ "id": "cc3e67f2-f20f-4430-8dee-d0773b90d9ce",
+ "cellValue": "tabSel",
+ "linkTarget": "parameter",
+ "linkLabel": "All Traffic",
+ "subTarget": "AllTraffic",
+ "style": "link"
+ }
+ ]
+ },
+ "name": "links - 7"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| project \r\n Timestamp = createdDateTime_t,\r\n User = userPrincipalName_s,\r\n SourceIP = SourceIP,\r\n DestinationIP = destinationIp_s,\r\n DestinationPort = destinationPort_d,\r\n Action = action_s,\r\n PolicyName = policyName_s,\r\n TransportProtocol = transportProtocol_s,\r\n TrafficType = trafficType_s,\r\n DestinationURL = destinationUrl_s,\r\n ReceivedBytes = receivedBytes_d,\r\n SentBytes = sentBytes_d,\r\n DeviceOS = deviceOperatingSystem_s,\r\n PolicyRuleID = policyRuleId_s\r\n| order by Timestamp desc",
+ "size": 3,
+ "showAnalytics": true,
+ "title": "Log",
+ "timeContextFromParameter": "TimeRange",
+ "showExportToExcel": true,
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "gridSettings": {
+ "rowLimit": 1000,
+ "filter": true
+ }
+ },
+ "conditionalVisibility": {
+ "parameterName": "tabSel",
+ "comparison": "isEqualTo",
+ "value": "AllTraffic"
+ },
+ "name": "query - 6"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "// Unique Users\nNetworkAccessDemo_CL\n| extend GeoInfo = geo_info_from_ip_address(SourceIP) // Extend each row with geolocation info\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\n| project SourceIP, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\n| summarize UniqueUsers=dcount(Country)\n| extend snapshot = \"Total Locations\"\n| project col1 = UniqueUsers, snapshot\n\n// Union with Unique Devices\n| union (\n NetworkAccessDemo_CL\n | where userPrincipalName_s in ({Users}) or '*' in ({Users})\n | extend BytesInGB = todouble(sentBytes_d + receivedBytes_d) / (1024 * 1024 * 1024) // Convert bytes to gigabytes\n | summarize TotalBytesGB = sum(BytesInGB)\n | extend snapshot = \"Total Bytes (GB)\"\n | project col1 = tolong(TotalBytesGB), snapshot\n)\n\n// Union with Total Internet Access\n| union (\n NetworkAccessDemo_CL\n | where userPrincipalName_s in ({Users}) or '*' in ({Users})\n | summarize TotalTransactions = count()\n | extend snapshot = \"Total Transactions\"\n | project col1 = TotalTransactions, snapshot\n)\n\n// Union with Total Private Access\n// Order by Snapshot for consistent tile ordering on dashboard\n| order by snapshot",
+ "size": 4,
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "tiles",
+ "tileSettings": {
+ "titleContent": {
+ "columnMatch": "snapshot",
+ "formatter": 1
+ },
+ "leftContent": {
+ "columnMatch": "col1",
+ "formatter": 12,
+ "formatOptions": {
+ "palette": "auto"
+ }
+ },
+ "showBorder": true,
+ "size": "auto"
+ },
+ "mapSettings": {
+ "locInfo": "LatLong",
+ "sizeSettings": "ExistingClients",
+ "sizeAggregation": "Sum",
+ "legendMetric": "ExistingClients",
+ "legendAggregation": "Sum",
+ "itemColorSettings": {
+ "type": "heatmap",
+ "colorAggregation": "Sum",
+ "nodeColorField": "ExistingClients",
+ "heatmapPalette": "greenRed"
+ }
+ },
+ "textSettings": {
+ "style": "bignumber"
+ }
+ },
+ "conditionalVisibility": {
+ "parameterName": "tabSel",
+ "comparison": "isEqualTo",
+ "value": "Overview"
+ },
+ "name": "query - 2"
+ },
+ {
+ "type": 12,
+ "content": {
+ "version": "NotebookGroup/1.0",
+ "groupType": "editable",
+ "items": [
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| extend BytesInGB = todouble(sentBytes_d + receivedBytes_d) / (1024 * 1024 * 1024) // Convert bytes to gigabytes\r\n| summarize TotalBytesGB = sum(BytesInGB) by bin(createdDateTime_t, 1h), trafficType_s\r\n| order by bin(createdDateTime_t, 1h) asc, trafficType_s asc\r\n| project createdDateTime_t, trafficType_s, TotalBytesGB\r\n",
+ "size": 2,
+ "title": "Usage over Time (GB)",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "barchart"
+ },
+ "conditionalVisibility": {
+ "parameterName": "tabSel",
+ "comparison": "isEqualTo",
+ "value": "Overview"
+ },
+ "name": "query - 0"
+ }
+ ]
+ },
+ "name": "group - 5"
+ },
+ {
+ "type": 12,
+ "content": {
+ "version": "NotebookGroup/1.0",
+ "groupType": "editable",
+ "items": [
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIP) // Extend each row with geolocation info\r\n| project createdDateTime_t, SourceIP, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| where Country != \"\"\r\n| summarize Count = count() by City, State, Country\r\n",
+ "size": 0,
+ "title": "Locations",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "map",
+ "mapSettings": {
+ "locInfo": "CountryRegion",
+ "locInfoColumn": "Country",
+ "latitude": "Latitude",
+ "longitude": "Longitude",
+ "sizeSettings": "Count",
+ "sizeAggregation": "Sum",
+ "labelSettings": "Country",
+ "legendMetric": "Country",
+ "legendAggregation": "Count",
+ "itemColorSettings": {
+ "nodeColorField": "Count",
+ "colorAggregation": "Sum",
+ "type": "heatmap",
+ "heatmapPalette": "turquoise"
+ }
+ }
+ },
+ "customWidth": "50",
+ "name": "query - 0"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where tolower(action_s) == \"allow\" and destinationWebCategory_displayName_s != '' // Filter for allowed traffic\r\n| extend firstCategory = tostring(split(destinationWebCategory_displayName_s, ',')[0]) // Split and get the first category\r\n| summarize Count = count() by firstCategory\r\n| top 10 by Count\r\n",
+ "size": 2,
+ "title": "Top Allowed Web Categories",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "piechart"
+ },
+ "customWidth": "50",
+ "name": "query - 7"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where tolower(action_s) == \"block\" and destinationFQDN_s != '' // Filter for allowed traffic\r\n| summarize Count = count() by destinationFQDN_s\r\n| top 100 by Count",
+ "size": 0,
+ "title": "Top Blocked Destinations",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces"
+ },
+ "customWidth": "50",
+ "name": "query - 5"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where tolower(action_s) == \"block\" and destinationWebCategory_displayName_s != '' // Filter for blocked traffic\r\n| extend firstCategory = tostring(split(destinationWebCategory_displayName_s, ',')[0]) // Split and get the first category\r\n| summarize Count = count() by firstCategory\r\n| top 10 by Count\r\n",
+ "size": 3,
+ "title": "Top Blocked Web Categories",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "piechart"
+ },
+ "customWidth": "50",
+ "name": "query - 6"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where sentBytes_d > 0\r\n| where tolower(action_s) != \"block\" \r\n| summarize Count = count() , Sent = sum(sentBytes_d), Recived = sum(receivedBytes_d), Total = sum(receivedBytes_d+ sentBytes_d) by destinationFQDN_s\r\n| order by Count desc\r\n",
+ "size": 0,
+ "title": "Top Allowed Destinations",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "gridSettings": {
+ "formatters": [
+ {
+ "columnMatch": "Count",
+ "formatter": 4,
+ "formatOptions": {
+ "palette": "magenta"
+ }
+ },
+ {
+ "columnMatch": "Recived",
+ "formatter": 4,
+ "formatOptions": {
+ "palette": "turquoise"
+ }
+ },
+ {
+ "columnMatch": "Total",
+ "formatter": 4,
+ "formatOptions": {
+ "palette": "pink"
+ }
+ },
+ {
+ "columnMatch": "Sent",
+ "formatter": 4,
+ "formatOptions": {
+ "palette": "blue"
+ }
+ }
+ ]
+ }
+ },
+ "customWidth": "50",
+ "name": "query - 1"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where transportProtocol_s != ''\r\n| summarize Count = count() by toupper(transportProtocol_s)\r\n| top 10 by Count\r\n",
+ "size": 2,
+ "title": "Protocol Distburion",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "piechart"
+ },
+ "customWidth": "50",
+ "name": "query - 3"
+ }
+ ]
+ },
+ "conditionalVisibility": {
+ "parameterName": "tabSel",
+ "comparison": "isEqualTo",
+ "value": "Overview"
+ },
+ "name": "group - 4"
+ }
+ ],
+ "fallbackResourceIds": [],
+ "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
+}
diff --git a/Workbooks/GSANetworkTraffic.json b/Workbooks/GSANetworkTraffic.json
new file mode 100644
index 00000000000..75f2f99880b
--- /dev/null
+++ b/Workbooks/GSANetworkTraffic.json
@@ -0,0 +1,421 @@
+{
+ "version": "Notebook/1.0",
+ "items": [
+ {
+ "type": 1,
+ "content": {
+ "json": "## Traffic Logs workbook\n---\n\nLog information in the dashboard is limited to 30 days."
+ },
+ "name": "text - 2"
+ },
+ {
+ "type": 9,
+ "content": {
+ "version": "KqlParameterItem/1.0",
+ "crossComponentResources": [
+ ""
+ ],
+ "parameters": [
+ {
+ "id": "ff8b2a55-1849-4848-acf8-eab5452e9f10",
+ "version": "KqlParameterItem/1.0",
+ "name": "LogAnalyticWorkspace",
+ "label": "Log Analytic Workspace",
+ "type": 5,
+ "description": "The log analytic workspace in which to execute the queries",
+ "isRequired": true,
+ "query": "resources\r\n| where type == \"microsoft.operationalinsights/workspaces\"\r\n| project id",
+ "typeSettings": {
+ "resourceTypeFilter": {
+ "microsoft.operationalinsights/workspaces": true
+ },
+ "additionalResourceOptions": [
+ "value::1"
+ ],
+ "showDefault": false
+ },
+ "timeContext": {
+ "durationMs": 86400000
+ },
+ "defaultValue": "value::1",
+ "queryType": 1,
+ "resourceType": "microsoft.resourcegraph/resources"
+ },
+ {
+ "id": "f15f34d8-8e2d-4c39-8dee-be2f979c86a8",
+ "version": "KqlParameterItem/1.0",
+ "name": "TimeRange",
+ "label": "Time Range",
+ "type": 4,
+ "isRequired": true,
+ "typeSettings": {
+ "selectableValues": [
+ {
+ "durationMs": 300000
+ },
+ {
+ "durationMs": 900000
+ },
+ {
+ "durationMs": 1800000
+ },
+ {
+ "durationMs": 3600000
+ },
+ {
+ "durationMs": 14400000
+ },
+ {
+ "durationMs": 43200000
+ },
+ {
+ "durationMs": 86400000
+ },
+ {
+ "durationMs": 172800000
+ },
+ {
+ "durationMs": 259200000
+ },
+ {
+ "durationMs": 604800000
+ },
+ {
+ "durationMs": 1209600000
+ },
+ {
+ "durationMs": 2419200000
+ },
+ {
+ "durationMs": 2592000000
+ }
+ ],
+ "allowCustom": true
+ },
+ "timeContext": {
+ "durationMs": 86400000
+ },
+ "value": {
+ "durationMs": 2592000000
+ }
+ },
+ {
+ "id": "8bab511b-53b3-4220-9d1c-372345b06728",
+ "version": "KqlParameterItem/1.0",
+ "name": "Users",
+ "type": 2,
+ "isRequired": true,
+ "multiSelect": true,
+ "quote": "'",
+ "delimiter": ",",
+ "query": "EnrichedMicrosoft365AuditLogsDemos_CL\r\n| summarize Count = count() by UserId_s\r\n| order by Count desc, UserId_s asc\r\n| project Value = UserId_s, Label = strcat(UserId_s, ' - ', Count, ' Logs'), Selected = false",
+ "typeSettings": {
+ "limitSelectTo": 20,
+ "additionalResourceOptions": [
+ "value::all"
+ ],
+ "selectAllValue": "*",
+ "showDefault": false
+ },
+ "timeContext": {
+ "durationMs": 0
+ },
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "value": [
+ "value::all"
+ ]
+ }
+ ],
+ "style": "pills",
+ "queryType": 1,
+ "resourceType": "microsoft.operationalinsights/workspaces"
+ },
+ "name": "parameters - 15"
+ },
+ {
+ "type": 11,
+ "content": {
+ "version": "LinkItem/1.0",
+ "style": "tabs",
+ "links": [
+ {
+ "id": "2b2cd1be-9d25-412c-8444-f005c4789b55",
+ "cellValue": "tabSel",
+ "linkTarget": "parameter",
+ "linkLabel": "Overview",
+ "subTarget": "Overview",
+ "style": "link"
+ },
+ {
+ "id": "cc3e67f2-f20f-4430-8dee-d0773b90d9ce",
+ "cellValue": "tabSel",
+ "linkTarget": "parameter",
+ "linkLabel": "All Traffic",
+ "subTarget": "AllTraffic",
+ "style": "link"
+ }
+ ]
+ },
+ "name": "links - 7"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| project \r\n Timestamp = createdDateTime_t,\r\n User = userPrincipalName_s,\r\n SourceIP = SourceIP,\r\n DestinationIP = destinationIp_s,\r\n DestinationPort = destinationPort_d,\r\n Action = action_s,\r\n PolicyName = policyName_s,\r\n TransportProtocol = transportProtocol_s,\r\n TrafficType = trafficType_s,\r\n DestinationURL = destinationUrl_s,\r\n ReceivedBytes = receivedBytes_d,\r\n SentBytes = sentBytes_d,\r\n DeviceOS = deviceOperatingSystem_s,\r\n PolicyRuleID = policyRuleId_s\r\n| order by Timestamp desc",
+ "size": 3,
+ "showAnalytics": true,
+ "title": "Log",
+ "timeContextFromParameter": "TimeRange",
+ "showExportToExcel": true,
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "gridSettings": {
+ "rowLimit": 1000,
+ "filter": true
+ }
+ },
+ "conditionalVisibility": {
+ "parameterName": "tabSel",
+ "comparison": "isEqualTo",
+ "value": "AllTraffic"
+ },
+ "name": "query - 6"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "// Unique Users\nNetworkAccessDemo_CL\n| extend GeoInfo = geo_info_from_ip_address(SourceIP) // Extend each row with geolocation info\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\n| project SourceIP, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\n| summarize UniqueUsers=dcount(Country)\n| extend snapshot = \"Total Locations\"\n| project col1 = UniqueUsers, snapshot\n\n// Union with Unique Devices\n| union (\n NetworkAccessDemo_CL\n | where userPrincipalName_s in ({Users}) or '*' in ({Users})\n | extend BytesInGB = todouble(sentBytes_d + receivedBytes_d) / (1024 * 1024 * 1024) // Convert bytes to gigabytes\n | summarize TotalBytesGB = sum(BytesInGB)\n | extend snapshot = \"Total Bytes (GB)\"\n | project col1 = tolong(TotalBytesGB), snapshot\n)\n\n// Union with Total Internet Access\n| union (\n NetworkAccessDemo_CL\n | where userPrincipalName_s in ({Users}) or '*' in ({Users})\n | summarize TotalTransactions = count()\n | extend snapshot = \"Total Trasnacations\"\n | project col1 = TotalTransactions, snapshot\n)\n\n// Union with Total Private Access\n// Order by Snapshot for consistent tile ordering on dashboard\n| order by snapshot",
+ "size": 4,
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "tiles",
+ "tileSettings": {
+ "titleContent": {
+ "columnMatch": "snapshot",
+ "formatter": 1
+ },
+ "leftContent": {
+ "columnMatch": "col1",
+ "formatter": 12,
+ "formatOptions": {
+ "palette": "auto"
+ }
+ },
+ "showBorder": true,
+ "size": "auto"
+ },
+ "mapSettings": {
+ "locInfo": "LatLong",
+ "sizeSettings": "ExistingClients",
+ "sizeAggregation": "Sum",
+ "legendMetric": "ExistingClients",
+ "legendAggregation": "Sum",
+ "itemColorSettings": {
+ "type": "heatmap",
+ "colorAggregation": "Sum",
+ "nodeColorField": "ExistingClients",
+ "heatmapPalette": "greenRed"
+ }
+ },
+ "textSettings": {
+ "style": "bignumber"
+ }
+ },
+ "conditionalVisibility": {
+ "parameterName": "tabSel",
+ "comparison": "isEqualTo",
+ "value": "Overview"
+ },
+ "name": "query - 2"
+ },
+ {
+ "type": 12,
+ "content": {
+ "version": "NotebookGroup/1.0",
+ "groupType": "editable",
+ "items": [
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| extend BytesInGB = todouble(sentBytes_d + receivedBytes_d) / (1024 * 1024 * 1024) // Convert bytes to gigabytes\r\n| summarize TotalBytesGB = sum(BytesInGB) by bin(createdDateTime_t, 1h), trafficType_s\r\n| order by bin(createdDateTime_t, 1h) asc, trafficType_s asc\r\n| project createdDateTime_t, trafficType_s, TotalBytesGB\r\n",
+ "size": 2,
+ "title": "Usage over Time (GB)",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "barchart"
+ },
+ "conditionalVisibility": {
+ "parameterName": "tabSel",
+ "comparison": "isEqualTo",
+ "value": "Overview"
+ },
+ "name": "query - 0"
+ }
+ ]
+ },
+ "name": "group - 5"
+ },
+ {
+ "type": 12,
+ "content": {
+ "version": "NotebookGroup/1.0",
+ "groupType": "editable",
+ "items": [
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| extend GeoInfo = geo_info_from_ip_address(SourceIP) // Extend each row with geolocation info\r\n| project createdDateTime_t, SourceIP, Country = tostring(GeoInfo.country), State = tostring(GeoInfo.state), City = tostring(GeoInfo.city), Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| where Country != \"\"\r\n| summarize Count = count() by City, State, Country\r\n\r\n",
+ "size": 0,
+ "title": "Locations",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "map",
+ "mapSettings": {
+ "locInfo": "CountryRegion",
+ "locInfoColumn": "Country",
+ "latitude": "Latitude",
+ "longitude": "Longitude",
+ "sizeSettings": "Count",
+ "sizeAggregation": "Sum",
+ "labelSettings": "Country",
+ "legendMetric": "Country",
+ "legendAggregation": "Count",
+ "itemColorSettings": {
+ "nodeColorField": "Count",
+ "colorAggregation": "Sum",
+ "type": "heatmap",
+ "heatmapPalette": "turquoise"
+ }
+ }
+ },
+ "customWidth": "50",
+ "name": "query - 0"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where tolower(action_s) == \"allow\" and destinationWebCategory_displayName_s != '' // Filter for allowed traffic\r\n| extend firstCategory = tostring(split(destinationWebCategory_displayName_s, ',')[0]) // Split and get the first category\r\n| summarize Count = count() by firstCategory\r\n| top 10 by Count\r\n",
+ "size": 2,
+ "title": "Top Allowed Web Categories",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "piechart"
+ },
+ "customWidth": "50",
+ "name": "query - 7"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where tolower(action_s) == \"block\" and destinationFQDN_s != '' // Filter for allowed traffic\r\n| summarize Count = count() by destinationFQDN_s\r\n| top 100 by Count",
+ "size": 0,
+ "title": "Top Blocked Destinations",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces"
+ },
+ "customWidth": "50",
+ "name": "query - 5"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where tolower(action_s) == \"block\" and destinationWebCategory_displayName_s != '' // Filter for blocked traffic\r\n| extend firstCategory = tostring(split(destinationWebCategory_displayName_s, ',')[0]) // Split and get the first category\r\n| summarize Count = count() by firstCategory\r\n| top 10 by Count\r\n",
+ "size": 3,
+ "title": "Top Blocked Web Categories",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "piechart"
+ },
+ "customWidth": "50",
+ "name": "query - 6"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where sentBytes_d > 0\r\n| where tolower(action_s) != \"block\" \r\n| summarize Count = count() , Sent = sum(sentBytes_d), Recived = sum(receivedBytes_d), Total = sum(receivedBytes_d+ sentBytes_d) by destinationFQDN_s\r\n| order by Count desc\r\n",
+ "size": 0,
+ "title": "Top Allowed Destinations",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "gridSettings": {
+ "formatters": [
+ {
+ "columnMatch": "Count",
+ "formatter": 4,
+ "formatOptions": {
+ "palette": "magenta"
+ }
+ },
+ {
+ "columnMatch": "Recived",
+ "formatter": 4,
+ "formatOptions": {
+ "palette": "turquoise"
+ }
+ },
+ {
+ "columnMatch": "Total",
+ "formatter": 4,
+ "formatOptions": {
+ "palette": "pink"
+ }
+ },
+ {
+ "columnMatch": "Sent",
+ "formatter": 4,
+ "formatOptions": {
+ "palette": "blue"
+ }
+ }
+ ]
+ }
+ },
+ "customWidth": "50",
+ "name": "query - 1"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "NetworkAccessDemo_CL\r\n| where userPrincipalName_s in ({Users}) or '*' in ({Users})\r\n| where transportProtocol_s != ''\r\n| summarize Count = count() by toupper(transportProtocol_s)\r\n| top 10 by Count\r\n",
+ "size": 2,
+ "title": "Protocol Distburion",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "piechart"
+ },
+ "customWidth": "50",
+ "name": "query - 3"
+ }
+ ]
+ },
+ "conditionalVisibility": {
+ "parameterName": "tabSel",
+ "comparison": "isEqualTo",
+ "value": "Overview"
+ },
+ "name": "group - 4"
+ }
+ ],
+ "fallbackResourceIds": [
+ ],
+ "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
+}
\ No newline at end of file
diff --git a/Workbooks/Images/Logos/gsa.svg b/Workbooks/Images/Logos/gsa.svg
new file mode 100644
index 00000000000..407569607d0
--- /dev/null
+++ b/Workbooks/Images/Logos/gsa.svg
@@ -0,0 +1,5 @@
+
diff --git a/Workbooks/Images/Preview/GSAEnrichedLogsBlack.png b/Workbooks/Images/Preview/GSAEnrichedLogsBlack.png
new file mode 100644
index 0000000000000000000000000000000000000000..e255e73c2ba95a19e201decc916ac03cdf623155
GIT binary patch
literal 192716
zcmdqJcTkhv*Dh>96ctfXkd9R8N|g>GB~UyIPhhwhVY8w;E0wyUqB-1PH}azWs-5`#)jd
z5`~_ATe}SO;r_mMx%y(Wp@;7`rw2?wOB-aK;+ZYdN1WWNq{}){Z!?`QXWcrFn=a>O
z75chmK9SnSh##W~`K0%#_PO|R;lwe$F7hCbfdq=?lNr8#KloC<+(8DN+0s>p$4a+$
zLhewU@1S_VwfaF=H;3L{Luce{?xAExZ!-N(+qF0@r##gu37e7kg~DEo=j_&}LDL1E
zy4j)e(T`$a8xTZ@N=R{dmo0hMvY)B%+jefynvgZ